The key facts
- Two critical PHP vulnerabilities, according to Wiz and Calif, had gone undetected for more than a decade; they were found by OpenAI's AI
- Finland and the Netherlands temporarily took government websites offline; Edinburgh City Council's site and BBC pages were unavailable
- NCSC, CERT-EU and other agencies urged users to urgently install the patch or take systems offline; Cloudflare reports early attacks
Websites taken offline while awaiting a patch
The government of Finland, Edinburgh City Council and the BBC were among the organizations that temporarily took websites and pages offline ahead of the release of a critical PHP update — the programming language on which many online services run. Two critical vulnerabilities have been discovered in PHP; the fix was released on Wednesday afternoon. Finland temporarily closed the government's public web services, and the Dutch cybersecurity agency reported taking its own website offline. The website of Edinburgh City Council also became unavailable, as did the online pages of a number of BBC programmes, including Doctor Who and The Traitors; they did not confirm a connection to PHP, and the BBC contacted them for comment.
AI found the vulnerabilities
The vulnerabilities were discovered by researchers at the companies Calif and Wiz, who used AI developed by OpenAI. According to the firms, they had gone unnoticed for more than ten years. Wiz called them 'the most serious vulnerabilities ever discovered' by this technology and noted in a blog post that 'frontier models were critical to making the process practical, enabling the development and adaptation of working exploits for several applications within hours.' The Netherlands' National Institute for Public Health and the Environment took its website offline, as did the lower house of the country's parliament — the Tweede Kamer.
Agency warnings and signs of attacks
The UK's NCSC, similar EU and Australian bodies urged PHP users to install the fixes. The NCSC recommended: 'If immediate remediation is not possible, organizations should consider taking the system offline until the threat is fully neutralized.' Similar warnings were issued by Japan's national cybersecurity office and EU officials. The company Huntress emphasized that 'PHP is everywhere' and quietly runs under WordPress, Drupal, Joomla, Magento, hosting providers and many programs. Sophos expert Don Smith told the BBC that the vulnerability 'is likely to become a priority target' for hackers, and that the main difficulty is finding all PHP instances, which are sometimes not obvious even to the organization itself. He added that it is important to watch for signs that an attacker 'may already have gained a foothold.' CERT-EU reported that risk assessments indicate the possibility of unauthenticated remote code execution, which could allow malware to be installed and websites to be taken down. Cloudflare's chief technology officer Dane Knecht said that 'we are seeing the emergence of early attacks, and we are updating protections as new vectors arise.'
Which versions are affected — unclear
It is not yet clear which versions of the language are affected, but according to CERT-EU, the vulnerability may affect all versions starting from PHP 5, released in 2004. The PHP Foundation released an update only for the newest versions, while users of PHP 8.1 and older are advised to upgrade. The NCSC also advised that, after installing the patch, users continuously monitor updates from third-party vendors, including devices and services into which PHP may be embedded.
Image source, Getty Images 
