Technology and Scienceupdated 1h ago2 min read
Governments Urge Website Shutdown After AI Finds Two Critical PHP Flaws
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
AI-discovered two critical PHP flaws affecting about 70% of websites caused global shutdowns. NSA urged patching or disconnecting vulnerable systems as governments paused operations worldwide.
Save coverage image
A wider view of the story
Explore source coverage 6 source types
Directory totals describe our source library, not outlets checked for this story.
21 outlets told this the same way.
Outlets did split on Toledo Fire & Rescue Orders Evacuations, Shelter-In-Place After Glycidyl Methacrylate Release →
AI finds PHP flaws
Websites worldwide were deactivated after governments and international organizations urged organizations to address two critical cybersecurity flaws found in PHP, a programming language that underpins a large part of the internet. Wiz said the vulnerabilities were the "most serious vulnerabilities ever uncovered" by this technology, and the BBC reported that the flaws were discovered by artificial intelligence (AI).
“The vulnerabilities were discovered by artificial intelligence (AI).”
A fix was published on Wednesday afternoon, while several cybersecurity agencies urged organizations that cannot apply the fixes in time to consider closing their websites. The BBC reported that the United States’ National Security Agency issued a similar advisory on X for organizations to disconnect their systems if they could not update them with the fix, and the BBC quoted the advisory that "These vulnerabilities typically provide a direct path to the server’s file system or database."
Shutdowns and access problems
Finland’s government temporarily shut down public web services, and the Netherlands’ cybersecurity agency announced it would disconnect its own site due to the vulnerabilities. The BBC reported that the Edinburgh City Council website became inaccessible, and it also reported that BBC online programs’ platforms, including Doctor Who and The Traitors, became inaccessible.
Wikimedia Foundation said it was addressing the vulnerabilities and that it had disabled other systems as a precaution, and the BBC reported that this led to some people being unable to access certain parts of Wikipedia on Wednesday. The United States’ National Security Agency issued a similar advisory on X, and the NCSC said "When an immediate solution is not feasible, organisations should consider disconnecting the system until the problem can be fully addressed."
What comes next
Don Smith, a cybersecurity expert with Sophos’ Threat Operations Unit, said this would likely be a top priority target for hackers, and he warned that the immediate challenge was finding and managing all instances where PHP was running. CERT-EU said the risk scores assigned to the vulnerabilities "indicate the potential for unauthenticated remote code execution," and it described how such an attack could allow hackers to install malicious software and sabotage websites.
Dane Knecht, Chief Technology Officer at Cloudflare, said the first attacks were appearing, and Huntress said "PHP is everywhere." OpenAI stated in a blog post that the discovery "marks a new phase, where AI can find security bugs with internet-scale impact," and it said the BBC could not verify the estimate that "around 70%" of the internet is affected.