Critical PHP flaws trigger global cybersecurity response
Websites worldwide faced disruption after critical vulnerabilities were disclosed in PHP, a programming language powering nearly 70% of websites. Governments and major organisations temporarily took some services offline while security teams worked to install fixes.
Governments and organisations race to secure vulnerable systems
The vulnerabilities, which became public on October 20, prompted warnings from national cybersecurity agencies in Washington and London. Millions of websites may need security updates, The Guardian reported.
Michał Woźniak, an internet infrastructure expert, warned that Russian state-linked actors or organised criminal groups could exploit the flaws to launch cyberattacks.
PHP is used by WordPress, Wikipedia's MediaWiki and other widely deployed web platforms. Slack and Facebook have also used PHP, although Facebook has moved much of its infrastructure to other technologies.
The Wikimedia Foundation said it had taken several systems offline on October 21 as a precaution until they could be patched.
The PHP development team released security fixes after researchers investigating cyber defences discovered the vulnerabilities.
The US National Security Agency advised organisations using PHP to disconnect affected systems from the internet if they could not patch them immediately. The agency warned that the flaws could provide direct access to a server's file system or database.
The UK's National Cyber Security Centre issued similar advice, urging organisations to check for backdoors installed by attackers.
Experts warn of a race to exploit the flaws
With patches now available, security experts fear attackers will use AI tools to reverse-engineer the vulnerabilities and develop exploits before organisations complete their updates.
AI was fuelling a “race to exploit,” said Costin Raiu, co-founder of a cybersecurity research and incident response firm. He warned that the next stage could involve mass compromise of vulnerable web servers.
“It was very surprising and concerning, given the worldwide prevalence of PHP. PHP released a patch very quickly. The most important thing is for everyone using it to install the update and ensure their systems are secure. The worrying part is that there will be a long tail of websites that may not be maintained as well and will remain vulnerable, meaning we could see weeks and months of continued attacks. As for the big, attractive targets, I sincerely hope they are patched quickly,” said Alan Woodward, a cybersecurity expert at the University of Surrey.
Woodward said malicious actors had an opportunity to exploit the gap between disclosure and remediation.
“There is this race and, unfortunately, some people don't even know they are in it,” he said.
AI's role in discovering the vulnerabilities
OpenAI said it had led a coalition of researchers involved in identifying the vulnerabilities and argued that frontier AI played a key role. However, the researcher who discovered one of the flaws said he had used publicly available models.
Cybersecurity company Calif said in a blog post that it had identified vulnerabilities with the help of a large language model on August 1 and had been working on a fix since then.
Wiz, the cybersecurity company owned by Alphabet, said it had independently discovered the flaws using its autonomous AI vulnerability research tool, Wiz Atlas, as well as Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol.
The vulnerabilities had remained hidden in PHP code for more than a decade and would have been extremely difficult for a human hacker to exploit, Wiz said.
Attacks reported before public disclosure
Amazon's head of security, CJ Moses, said in a blog post that his team had detected an attempted exploit against one of its honeypot systems on October 17, four days before public disclosure.
The attempt originated from an anonymous internet address, suggesting malicious activity, Moses said. It remains unclear how the attacker learned about the vulnerabilities while details were still under embargo.
The White House said it had been informed about the security issue.
In the UK, council websites in Edinburgh, Bristol and Oxford were taken offline.
In France, local government websites, including the Paris police prefecture, were taken offline on Wednesday. In the Netherlands, affected services included the national digital identity system, the House of Representatives website and the National Cyber Security Centre website.
The Australian Signals Directorate was also temporarily affected by an overnight service disruption, local time. The country's national cyber defence agency said other government websites might have experienced similar problems.
Long-standing weaknesses in internet infrastructure
Woźniak warned that the vulnerabilities could be exploited automatically on a large scale.
“The bug could allow cryptocurrency miners to exploit vulnerable servers at other people's expense,” he said.
He added that major criminal organisations and Russian state-linked actors could use compromised websites as launching points for distributed denial-of-service (DDoS) attacks and other cyber operations.
The incident exposed long-standing weaknesses in internet infrastructure, Woźniak said. Advanced AI models had helped bring the problem to light, but the underlying weaknesses had existed for years.
“This is an environmental problem in an industry where there is an incentive to move fast and make changes. There is an incentive to deploy something and then never update it again or think about maintenance,” he said.
Translation by Iurie Tataru
RELATED COVERAGE
