Photo credit, Getty Images
For more than a decade, serious flaws have gone unnoticed in the technology that underpins much of the Internet.
It took artificial intelligence (AI) to uncover them, triggering a global cybersecurity alert.
These vulnerabilities are found in a programming language called PHP, used internationally since the 2000s to create websites.
Governments and cybersecurity agencies around the world are working to limit the impact of Wednesday's discovery, and have urged website operators to install a new emergency patch or consider taking their platforms offline.
Cybersecurity firm Wiz – one of the companies whose researchers uncovered these flaws – called the flaws “the most serious” ever detected by AI.
OpenAI, whose technology helped detect the flaws, called the discovery "one of the most serious security issues in recent years."
End of content
Where does the flaw lie?
Most people may have never heard of PHP – short for “PHP: Hypertext Preprocessor” – but they certainly encounter it on a daily basis.
PHP is the basis of a large number of platforms, including online stores, Wikipedia and WordPress – the content management system that underpins many websites such as blogs.
End of Most read
When you visit a website like Wikipedia, it's the PHP code that brings together the information you need and presents it in a web-readable form, Paul Spain, managing director of Gorilla Cyber Security, told the BBC.
But due to a flaw that could allow hackers to take control of affected web servers without authentication and steal sensitive data, all applications developed in PHP found themselves exposed.
AI could facilitate and accelerate these types of attacks, Mr. Spain said, estimating that this flaw could affect “millions and millions” of websites.
It would be "catastrophic" if hackers or states used the flaw for malicious purposes and stole private data from websites, said Jill Slay, a cybersecurity researcher at the University of Adelaide.
Which websites were affected?
This alert disrupted services globally, from gaming platforms to government portals to online forums.
This is particularly the case for Wikimedia — the organization behind the online encyclopedia Wikipedia — which has taken several of its systems offline as a precautionary measure.
Sites and pages were taken offline by the Finnish government, Edinburgh City Council and the BBC, while the Dutch cybersecurity agency also took down its website.
Photo credit, EPA
A number of Scottish public bodies, including local councils and health boards, have also taken their websites offline.
Some experts warn that this vulnerability could put poorly maintained websites, especially those owned by small organizations with limited security resources, at increased risk.
Further attempts to exploit these flaws are expected in the coming weeks as the technical details are now made public, said Salil Kanhere, a cybersecurity researcher at UNSW Sydney.
What happened after these flaws were revealed?
Verified information at your fingertips
Click here and subscribe!
End of WhatsApp Promotion
The developers of the PHP platform released patches on Wednesday aimed at correcting security flaws that had been hiding in their software for years.
“All PHP users are strongly encouraged to update without delay,” the company said.
Authorities and security organizations around the world have echoed these warnings, urging website operators to secure their platforms.
The US National Security Agency (NSA) has asked all organizations using PHP to take their systems offline if they are unable to apply patches immediately, adding that the flaw could provide "direct access" to exploit a system's database.
“These risks are serious enough to require immediate remediation across all U.S. government departments and agencies,” the agency said.
The UK's National Cyber Security Center has issued similar recommendations and advised organizations to check for "hacker-installed backdoors".
Its counterparts in the European Union, Singapore and Australia have also issued similar alerts.
Japanese Prime Minister Sanae Takaichi urged people to check whether their publicly accessible websites run PHP.
Photo credit, Bloomberg via Getty Images
“We urge everyone to take action tonight,” Ms. Takaichi wrote on X.
“While it is difficult to implement the patch quickly, temporarily suspending websites and other similar measures can be considered an effective way to reduce risks,” she said.
Technology companies are also racing to secure their systems.
E-commerce giant Amazon said it was the target of multiple attempts days before the PHP flaw was publicly disclosed. It is unclear how potential attackers became aware of this vulnerability.
How does AI identify weak points?
These flaws were discovered by researchers from security companies Calif and Wiz.
These researchers used advanced artificial intelligence tools that can analyze code and detect flaws much faster than humans or legacy systems can.
“Modern software is incredibly complex, and some flaws can go unnoticed for years,” Kanhere said.
“The underlying bugs were not new; what has changed is our ability to detect them,” Kanhere added.
Details concerning this discovery leaked on the Internet this week, forcing the developers of the PHP platform to urgently announce the existence of this security flaw and its considerable scale.
The incident “highlights AI's ability to detect security vulnerabilities,” but also how it can “help hackers quickly develop offensive tools and exploits,” OpenAI said in a blog post.
The creator of ChatGPT indicated that it has published a program to check whether the PHP platform is secure.
"Many of these flaws come from the way software has been designed in the past, which is to prioritize functionality over security," said Ryan Ko of the Cyber Research Center at the University of Queensland.
What can people do to protect themselves?
Website owners are advised to secure their sites using the latest version of PHP.
This PHP patch is a small, routine update for most tech teams, Spain said.
The US National Security Agency (NSA) has called for “increased vigilance” over the coming weeks and to closely monitor updates proposed by software publishers.
“It is essential to be vigilant when patching these systems,” she said.
The responsibility lies primarily with website operators, but users should remain attentive to any security advice issued by relevant services, such as password change requests, Kanhere said.
He also warned the public to be wary of any phishing messages exploiting the media coverage of this incident.
Discover more
Look!
End of Look!
