PHP Flaw Found With AI Forces Websites Offline Worldwide
Governments in Belgium, the Netherlands, France, Finland and Germany temporarily took websites offline as they patched a critical flaw in PHP, a programming language used by almost 70 percent of websites. Researchers found the weakness with the help of artificial intelligence (AI) models. It became public on Tuesday and a fix followed on Wednesday, the Guardian reported on 22 October. Security agencies in Washington and London issued warnings.
The US National Security Agency (NSA) told organisations that cannot patch immediately to take their systems offline, warning the flaw could "provide a direct path to the server's file system or database". The security firm Calif said it found the flaws with a large language model, the AI behind chatbots, on 1 August. Wiz, owned by Alphabet, said the bugs had stayed hidden in PHP for more than a decade. Councils in Edinburgh, Bristol and Oxford, the Paris police prefecture and the Dutch digital identity service went offline.
Attacks may have begun before the fix. Amazon said a decoy system it runs saw an exploit attempt on 17 October, four days before disclosure, and that it does not know how the attacker learned of the flaw. Alan Woodward of the University of Surrey expects poorly maintained websites to stay vulnerable, with "weeks and months of ongoing attacks".
Every PHP website operator now has to install the fix or, as the NSA advises, go offline. Britain's National Cyber Security Centre also told organisations to check for "backdoors installed by an attacker". Wikimedia keeps several systems down until they are patched.
The cards of this story
from the video, click to enlarge
Sober, well-sourced report that names a fix and concrete steps, and admits uncertainty about earlier attacks, though it focuses mostly on the threat.
The text names a patch, gives clear advice from the NSA and Britain's cyber agency, and backs its claims with dates, named institutions and quotes. It is honest about limits: Amazon does not know how the attacker learned of the flaw, and an expert expects months of ongoing attacks. Most of the text still describes the problem and its disruption rather than how defence works well. More detail on how quickly patches are rolling out, or on what makes the AI-driven discovery useful for defenders, would raise the score.
AI assessment by fixed criteria. How we score →
