Researchers using artificial intelligence uncovered critical security flaws in the PHP programming language that affect a large part of the web. After the vulnerabilities were disclosed, the PHP development team issued emergency patches and urged all users to update immediately.
Who found the flaws and how
Two independent cybersecurity firms found the vulnerabilities using AI tools: Calif and Wiz (the latter is an Alphabet-related company). According to Wiz, human analysts would have struggled to exploit the bugs, but AI bridged that gap and enabled practical analysis. The two companies worked with the PHP development team and OpenAI to develop the security fixes.
Scale and impact
PHP powers about 75 percent of websites and underpins popular content management systems such as WordPress, Drupal and Joomla. The Drupal Association's executive director said that all PHP releases from the past twenty years are affected. Data from Censys indicate that of roughly 2.6 million servers running PHP, about 1.5 million do not yet have an available patch, leaving a large number of systems potentially vulnerable.
Early attacks and official warnings
Amazon's cybersecurity chief reported that on October 17 — four days before the public disclosure of the vulnerabilities — they already detected an attack attempt against one of their honeypots. According to the statement, attackers have since been "widely exploiting" the flaws. The National Cyber Security Centre issued an alert detailing recommended actions and the available information.
European shutdowns and precautionary steps
The disclosure prompted immediate responses across Europe. In the Netherlands the National Cyber Security Centre took its website offline; others followed suit. Several high-profile sites became unreachable, including the Port of Rotterdam, the Overheid.nl government portal, the Dutch football association, the websites of the five largest political parties and multiple hospital sites. The Dutch prime minister said he is closely monitoring developments.
Finland saw the most extensive shutdowns, where the state IT service provider Valtori proactively took all government web services offline. In France the interior ministry set all its websites to maintenance mode, and in Denmark the municipal IT company Kombit suspended several services, including the national school communication platform. The Wikimedia Foundation and the Internet Archive also took some systems offline until updates were applied.
A speeding race between patches and exploit generation
Experts warn that AI-based tools can rapidly convert published fixes into working exploit code by reverse-engineering patches. That creates a tight race between organisations applying security updates and attackers developing and deploying exploits. Smaller organisations and individual website operators with limited technical resources are at highest risk, particularly those on shared hosting without direct server configuration access.
Recommended actions for users
Developers and cybersecurity authorities are urging immediate application of the provided patches. The National Cyber Security Centre's alert contains step-by-step guidance for affected parties. The most effective mitigation remains rapid installation of updates and close monitoring of affected systems' traffic.
(This article was prepared with assistance from an AI tool; the final content was edited and verified by our journalist.)
