Why a flaw in PHP has put the internet's underlying code under scrutiny

AI tools helped researchers uncover serious weaknesses in PHP, raising fresh questions about how artificial intelligence could transform both cyber-security and hacking

 A critical security flaw in PHP, a programming language used by a large share of the world's websites, has triggered an international cybersecurity response, with government agencies and website operators racing to install fixes or temporarily take vulnerable services offline.

 

The vulnerabilities could allow hackers to execute malicious code on affected servers, potentially exposing sensitive information and compromising websites.

 

The discovery also highlights how artificial intelligence (AI) is changing cyber-security by helping researchers uncover weaknesses in software that may have remained hidden for years.

 

What is PHP?

 

PHP, which originally stood for Personal Home Page, is now known as PHP: Hypertext Preprocessor. It is an open-source programming language used primarily to build websites and web applications.

 

 

PHP runs on a web server and helps generate the content users see in their browsers. It can process information submitted through forms, interact with databases, manage user logins and power dynamic features such as online shopping carts.

 

PHP is widely used because it is free, flexible and supported by a large developer community. According to web technology tracker W3Techs, it runs on nearly 70 per cent of websites whose server-side programming language is known.

 

It also powers WordPress, the content management system used by a substantial share of websites worldwide, including news platforms, blogs, business websites and online stores. Other platforms and applications, including Drupal, Joomla and Magento, also use PHP.

 

This widespread adoption means a vulnerability in PHP can have consequences far beyond a single website or organisation.

 

Why is PHP a security risk?

 

The emergency followed the discovery of two critical vulnerabilities in PHP that could allow attackers to run unauthorised code remotely on affected systems.

 

Such an attack, known as remote code execution, can give hackers a way to execute commands on a server over the internet. Depending on the system's configuration and the attacker's access, this could enable them to steal data, install malicious software, alter website content or compromise connected systems.

 

The flaws were reportedly present for years and were difficult to exploit using conventional techniques. However, researchers used advanced AI tools to identify and demonstrate how they could be exploited, prompting an urgent response from PHP developers and cyber-security agencies.

 

The scale of PHP's use compounded the challenge because organisations needed to identify every affected system, apply the relevant fixes and check whether attackers had already gained access.

 

Which sites were affected?

 

The security warning prompted organisations in several countries to take precautionary measures while fixes were prepared or installed.

 

According to reports, affected or precautionarily restricted services included:

 

• Finland's government websites, which were temporarily taken offline
• The Netherlands' cyber-security agency and other public institutions
• Edinburgh City Council's website and some BBC programme websites
• Parts of Wikipedia

 

Cyber-security agencies in the UK, European Union, Australia and the US urged organisations to address the vulnerabilities urgently. Guidance included temporarily disconnecting affected systems where immediate remediation was not possible.

 

How AI uncovered the flaws

 

Researchers at cyber-security firms Calif and Wiz used advanced AI models to help identify and investigate the flaws.

 

The findings illustrate how AI can assist security researchers in examining complex software, identifying weaknesses and developing methods to demonstrate whether those weaknesses can be exploited.

 

According to BBC, one vulnerability was reported to PHP developers by researchers at Calif on August 11, while Wiz independently identified another and reported it on August 24.

 

How can websites stay safe?

 

Organisations using PHP have been urged to install the security updates released by its developers and check all systems that may rely on the software, including third-party applications and hosting services.

 

They should also review security logs for signs of suspicious activity, since applying a patch does not necessarily remove an attacker who may have already accessed a system.

 

For organisations unable to secure vulnerable systems immediately, cyber-security agencies have advised temporarily taking them offline until the risk can be addressed.