AI Found Two Critical PHP Flaws, and Agencies Urged Unpatched Sites to Consider Going Dark
International governments and agencies are urging websites to address two critical cyber-security flaws in a programming language that powers much of the internet. The vulnerabilities sit inside PHP, and a fix was issued on Wednesday afternoon.
Multiple cyber-security agencies went further, urging organisations that cannot apply the fix in time to consider taking their sites down; the Finnish government, Edinburgh council and the BBC took pages offline.
The BBC reports the flaws were discovered by AI, and cyber-security firm Wiz called them the most severe vulnerabilities ever discovered by the technology.
AI-generated discussion · Different perspectives
The firms involved say the flaws went undetected for more than a decade. The part worth sitting with is who eventually found them: AI, in a category Wiz is already calling its most severe discovery yet.
Finding them is the dramatic half. Cyber-security expert Don Smith, from the Sophos Counter Threat Unit, told the BBC this would likely be a priority target for hackers. He calls PHP pervasive — sitting beneath public websites, content-management systems, hosting platforms and third-party products, sometimes without the organisation even realising it, and you cannot patch a copy of PHP you do not know you are running.