The PHP programming language, which runs about 70% of all websites in the world, has been hit by two critical vulnerabilities. The PHP Foundation and the FBI's cyber division reported this, issuing emergency recommendations on Wednesday. Agencies, corporations and other organizations were forced to react urgently.
PHP is a free, open-source language focused on web development. It runs the popular content management systems WordPress and Drupal, as well as MediaWiki - the software behind Wikipedia. Many government websites also use PHP.
The vulnerabilities allow attackers to gain unauthenticated access to websites, that is, without a password. According to James Sullivan, director of cybersecurity and technology at the London-based Royal United Services Institute for Defence and Security Studies (RUSI), this makes it possible to remotely control a web server, steal or alter data, and use the system for further attacks.
In connection with the recommendations, several websites were temporarily taken offline. The disruptions affected government services and websites in the UK, Finland and Japan. Some resources may remain unavailable, since different software requires different patches (fixes) that still need to be obtained and tested.
According to the PHP Foundation, the vulnerabilities had been known since at least 2024. Security specialists developed several competing solutions, but each had drawbacks, and no practical attack method appeared to exist, so work on a fix stalled. The organization acknowledged responsibility for the delay, calling it a "structural failure" caused both by the security team's decision-making process and by a lack of resources. Some experts believe the vulnerabilities may have been discovered even earlier.
This time, artificial intelligence came to the rescue. OpenAI said that over the past two months it has led a coalition of researchers and security service providers to address the problems in PHP. Specialists at the cloud platform Wiz also independently used AI to identify the vulnerabilities.
The availability of AI means that both large and small organizations have gained more advanced tools for proactive and reactive defense. However, attackers have the same weapon and can exploit digital weaknesses at scale. Sullivan considers such a confrontation alarming but notes a positive example: "We saw a worthy case where AI detects critical vulnerabilities and the community unites to fix them."