The key facts
- Critical PHP vulnerabilities, present for at least ten years, were discovered with the help of AI; details leaked to social media before the official release
- Amazon reported exploitation attempts on 17 and 21 October; the NCSC and agencies in the US, EU and Australia urged installing patches or taking systems offline
- According to Wiz's estimate, about 70% of the internet is affected; the Netherlands, Finland and Wikipedia partially took services offline
The UK checks its services
The UK government said it is working to identify a potential vulnerability in its online services after critical vulnerabilities were discovered in the PHP programming language, which powers a significant portion of the world's websites. A government spokesperson urged 'all organisations, private and public, large and small' to follow recommendations for protecting systems. The UK's National Cyber Security Centre (NCSC), as well as similar agencies in the EU and Australia, urged PHP users to install fixes. The NCSC noted: 'If immediate remediation is not possible, organisations should consider taking the system offline until the threat is fully addressed.'
Amazon reports attack attempts
Amazon announced that it detected an attempt to exploit the 'PHP2Shell' vulnerability on 17 October. According to the company's head of security, CJ Moses, an anonymous IP address attempted to attack one of its decoy systems ('honeypots'), indicating the actions of a 'threat actor'. The company said the attacks occurred before the embargo on the warning was lifted, and it does not know how attackers learned about the vulnerabilities. In the 21 October attacks, 'the payloads and anonymisation infrastructure differed, suggesting multiple actors', Moses added. In his words, the use of AI means that 'more actors can act within hours or even minutes after the technical details of a vulnerability are disclosed'.
Leak before the official release
The PHP Foundation had planned to announce the discovery of the vulnerabilities later this month along with a full patch, but details of the leak appeared on social media on Tuesday. Attacks on Amazon after the leak occurred before the official lifting of the embargo on the warning.
Scale of the problem and reaction
The vulnerabilities had gone undetected for at least ten years. The cyber company Wiz estimated that 'roughly 70%' of the internet is affected; the BBC cannot independently verify this figure. PHP underpins many platforms, including online stores, Wikipedia and WordPress. The Dutch cybersecurity agency took itself offline as a precaution, Finland shut down government web services, and Wikipedia removed part of its site — in line with recommendations from governments, including the US. The US National Security Agency said the vulnerabilities 'often provide a direct path to a server's file system or database' and allow attackers to 'steal sensitive data, disrupt services or move deeper into a network', emphasising that these are flaws in PHP itself, not in hosted applications. OpenAI called the discovery 'one of the most significant security incidents in recent history'.
The role of AI
Anna-Maria Arabia, chief executive of the Australian Council for AI Strategy, told the BBC that the PHP incident 'showed how quickly AI is changing the cybersecurity landscape': 'what used to take months to discover a vulnerability now takes days'. She warned that threats will become increasingly widespread as AI technologies improve — 'this, in other words, will not go backwards'.
Image source, Getty Images 
