Governments and agencies have urged the resolution of two critical cybersecurity flaws in the programming language that underpins a large portion of the internet, reports the BBC.The vulnerabilities were discovered in the PHP programming language, and a fix was released on the afternoon of the 21st of October. Several cybersecurity agencies advised organizations unable to apply the fix to temporarily take their websites offline; consequently, sites belonging to the Finnish government, the Edinburgh City Council, and the BBC—among others—became inaccessible.The flaws were identified with the help of artificial intelligence, and the cybersecurity firm Wiz noted that these are the most serious vulnerabilities discovered by AI to date.Finland was forced to temporarily shut down its publicly accessible government websites, while the Dutch cybersecurity agency reported that it had taken its own website offline due to the vulnerabilities. The US National Security Agency also issued a statement advising organizations unable to perform the necessary updates to temporarily suspend the operation of their websites. The discovered vulnerabilities provide direct access to server files and databases. The White House reported that federal agencies are collaborating with leading artificial intelligence developers to accelerate the implementation of fixes.In a post on the X, Japanese Prime Minister Sanae Takaichi urged the public to check whether their websites—or any sites they use—rely on PHP.The Wikimedia Foundation, which operates the online encyclopedia Wikipedia, stated that it is addressing security vulnerabilities. For security reasons, several systems have been temporarily taken offline until they can be safely updated; consequently, parts of the online encyclopedia were inaccessible on the 21st of October.A number of other websites, such as the art platform DeviantArt, were also temporarily taken offline for “maintenance,” though no specific reason was provided.The vulnerabilities were discovered by cybersecurity researchers at the firms Calif and Wiz. Calif, in partnership with the PHP Foundation, has joined OpenAI’s Patch the Planet initiative. This initiative provides organizations with access to powerful tools developed by AI experts to identify and remediate flaws in the web development language. OpenAI noted that one of the most significant security issues in recent times has been uncovered. The flaws had gone unnoticed for over a decade and were discovered in August with the help of advanced artificial intelligence tools. It is estimated that these vulnerabilities affect more than 70% of the internet, though the BBC has been unable to verify this figure.The PHP Foundation had planned to disclose the vulnerabilities at a later date, alongside a complete fix; however, information was leaked on social media on October 20. This forced the organization to accelerate the release of an official statement regarding the vulnerability and its scope.Cybersecurity firm Huntress noted that the PHP language is ubiquitous. It underpins services such as WordPress, Drupal, Joomla, and Magento, as well as sharing platforms, control panels, and various other tools that do not explicitly advertise their use of PHP.Cybersecurity expert Don Smith told the BBC that this could become a prime target for cybercriminals. The primary challenge lies not in applying the fixes, but in identifying and managing every individual instance where PHP is used. He pointed out that the use of PHP is pervasive—appearing in public-facing websites, management systems, sharing platforms, and third-party products—often without the organizations using them even being aware of it. It is crucial for organizations to look for signs that attackers may have already gained access to their systems.CERT-EU indicated that the risk assessments assigned to these vulnerabilities point to the possibility of remote code execution without authentication. This type of cyberattack would allow criminals to install malware and disrupt the operation of websites.
Serious programming language vulnerability discovered; millions of websites affected
