AI has exposed critical security holes in PHP, a major programming language that powers most of the internet. Many websites went dark on Thursday as organisations race to patch their systems before hackers can exploit the flaws.
Security experts found the vulnerabilities using advanced AI models in August, but kept the discovery secret while developers worked on a fix. The PHP Foundation released a patch on Wednesday, urging all users to update immediately.
AI uncovers decade-old security holes
Wiz Research used AI to discover vulnerabilities that had lurked in PHP for more than 10 years. The company calls PHP “a backbone of the web” – and for good reason. The programming language, created in the early 1990s, runs an estimated 70% of the world’s websites.
PHP originally stood for Personal Home Page. It powers popular web design platforms, which means the security flaws could let hackers break into everything from online shops to government services.
Security firm Calif also found the same flaws during an OpenAI-funded audit of PHP’s code. OpenAI called the discovery “one of the most impactful vulnerabilities in recent memory”, adding that it “marks a new phase, where AI can find security bugs with internet-scale impact”.
Why websites went offline
The PHP Foundation warned tech departments worldwide: “If you run PHP, it is imperative that you update now.” This triggered a wave of precautionary shutdowns as developers worked to protect their code.
Sites ranging from the Paris police website to a Pokemon sleep tracker went offline. Dimitrios Salampasis from Australia’s Swinburne University of Technology explained that taking websites offline does not mean they have been hacked.
“It can be a responsible measure to protect systems while security updates are applied,” he said.
Steve Kerrison, senior lecturer in cybersecurity at James Cook University’s Singapore campus, told AFP that AI poses a double-edged sword.
“The trouble with tools like AI is that the moment all the information’s out there, people can weaponise it very, very quickly,” Kerrison said. “That’s why everybody’s acting with such urgency to respond to this issue.”
No confirmed attacks yet
Security researchers have found no evidence that anyone has actively launched attacks using the newly discovered techniques. Kerrison said larger organisations, from government agencies to news outlets, should be able to fix their websites relatively quickly.
ALSO READ: Anthropic bans users from being cruel to Claude AI chatbot
However, smaller sites may remain at risk. “There are sites, systems and people out there who will have no idea about this and still won’t for days, weeks and months,” Kerrison warned.
User-run blogs could become targets for spreading computer viruses, spam or malicious content.
Future risks remain
A data breach could affect customers in the future if hackers steal personal information to use in phishing attacks. These scams trick people into revealing passwords to online services.
The complex nature of online systems creates another problem. Many websites use third-party interfaces, which means some vulnerabilities could persist even after organisations apply the patch.
Rahat Masood, senior lecturer in cyber security at the University of New South Wales in Sydney, explained: “If the third parties use PHP, then even though you patched yourself… you’re still unsecure.”
Kerrison added that strong cybersecurity needs several layers of defence, not just PHP updates.
