From The Verge · Terrence O'Brien · · 2m
PHP vulnerabilities shut down sites worldwide
Two critical flaws in PHP, found by AI, have forced major websites and government agencies offline and exposed billions of users to potential attack.
In brief
Two critical flaws in PHP, found by AI, have forced major websites and government agencies offline and exposed billions of users to potential attack. Critical vulnerabilities in PHP, discovered using AI, forced 4chan, DeviantArt, Wikipedia and government sites offline; patches are now urgent across the internet…
Two PHP bugs take down the internet
Critical vulnerabilities in PHP shut down 4chan, DeviantArt, Wikipedia, and Pokémon Home today. Dutch and Finnish government agencies also took sites offline as a precaution.
PHP powers most of the web
W three Techs says PHP is used by sixty-nine point three percent of all websites whose server-side programming language is known, including Wikipedia and WordPress.
The bug hid for twenty years
The vulnerability existed in PHP for roughly twenty years but required an exceptionally complex chain of steps to exploit. AI models have now made it much easier to weaponise.
“required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve”
OpenAI and Wiz found the flaws
OpenAI's security group Calif identified a critical PHP flaw using GPT-five point six Sol. Google-owned Wiz independently discovered and reported the vulnerabilities using AI.
Attackers can run code remotely
The PHP Group says hackers could use the vulnerabilities for unauthenticated remote code execution, running their own code, changing content, and accessing stored data without login.
This is among history's worst flaws
OpenAI called this one of the most impactful security issues in recent memory. Wiz said it is among the most severe vulnerabilities discovered in software history.
“We consider this one of the most impactful security issues in recent memory.”
Attacks are already emerging
The CTO of Cloudflare said last night that it was seeing early attacks emerging. Attackers could gain access to passwords, API keys, certificates, and databases of sensitive information.
Sites must patch or go offline
GoDaddy says any site using PHP should assume it is affected and update immediately. Sites running PHP eight point one or older should upgrade, as they are no longer supported.
Users should check before visiting
As a user, check social accounts of sites you frequently use for updates before visiting. If you have a website, check what version of PHP it runs and update immediately.
The key point
Critical vulnerabilities in PHP, discovered using AI, forced 4chan, DeviantArt, Wikipedia and government sites offline; patches are now urgent across the internet.
