PHP flaws prompt urgent global patching response
AI-assisted research uncovered long-standing vulnerabilities in PHP, prompting authorities to urge operators to patch affected systems or take them offline.
Long-standing flaws in PHP have triggered warnings from cyber-security authorities across the US, UK, EU and Australia. The vulnerabilities may allow unauthorised control of affected servers and access to sensitive data, though the supplied report records no confirmed compromises or verified exploitation.
PHP is used to build many websites and platforms, including WordPress and Wikipedia. Researchers at security firms Calif and Wiz used AI tools to identify bugs that, according to the report, had existed for years. PHP developers released patches after details of the flaws leaked online.
The US National Security Agency advised organisations to take PHP systems offline if they could not patch them immediately. The UK’s National Cyber Security Centre urged organisations to check for backdoors, while authorities in the EU and Australia issued similar alerts.
Some organisations temporarily took services offline as a precaution, including Wikimedia and public bodies in Finland, Scotland and the Netherlands. The report also said the University of Geneva’s website was taken offline.
Researchers warned that attempts to exploit the flaws may rise as technical details become public. The number of vulnerabilities and affected PHP versions was not specified, and exposure depends on whether a system runs an affected version and has been patched.
The incident has highlighted how AI can help researchers find flaws in complex software, while also raising concern that attackers could use the technology to develop exploits more quickly. Operators were urged to install the available fixes and monitor security updates.
