AI Helps Discover Critical Flaws in PHP Used by 70% of Websites
Wiz Research, using OpenAI technology, found severe vulnerabilities in PHP, prompting global government and corporate patching efforts.
At a glance
- Wiz Research, using OpenAI technology, discovered severe flaws in PHP, which runs about 70 percent of websites.
- The vulnerabilities could allow attackers to control servers, steal data, and deface websites.
- Governments including the U.K., Japan, and France ordered urgent updates or took services offline.
Cybersecurity firm Wiz Research, working with OpenAI technology, disclosed severe flaws in the PHP programming language this week. The vulnerabilities affect code used on roughly 70 percent of the world's websites and could allow attackers to take control of servers, steal sensitive data, and deface websites, according to Wiz Research.
The PHP Foundation has released two patches to address the issues. Wiz Research announced the discovery on Wednesday, and OpenAI described the bug as one of the most impactful vulnerabilities in recent memory.
Governments and corporations from the United Kingdom to Japan moved quickly to limit exposure. The U.S. National Security Agency told organizations using PHP to maintain heightened awareness, while Britain's National Cyber Security Center urged immediate updates. Dozens of British and Finnish government services were taken offline, and French local government sites were briefly shut down. China's Industry Ministry asked entities to review security gaps.
In Japan, Prime Minister Sanae Takaichi issued an urgent request for action, saying websites could be temporarily suspended if patches could not be applied quickly. Matthew Prince, head of Cloudflare, said his firm observed tens of thousands of exploitation attempts within the first 45 minutes of disclosure, rising to millions by Thursday.
Wiz Research said exploiting the flaws previously required an exceptionally complex chain of steps at the edge of what human researchers could practically achieve. The firm said AI models substantially reduced that barrier, turning a longstanding weakness into an active exploit.
Numerous websites and pages were taken offline in recent days as countries scrambled to prevent cyberattacks.
Source: NPR News.
Questions and answers
- What is PHP and why are the flaws serious?
- PHP is a programming language used on about 70 percent of the world's websites. Wiz Research says the flaws could let attackers take over servers, steal data, and deface sites.
- Who discovered the PHP vulnerabilities?
- Cybersecurity firm Wiz Research discovered the flaws using OpenAI technology and announced them on Wednesday.
- What are governments doing about the PHP flaws?
- The U.S. NSA, U.K. NCSC, and officials in Japan, France, Finland, and China have urged organizations to patch PHP or temporarily suspend affected sites.
