AI Uncovers Deep Flaws in PHP, Triggering a Global Cyber-Security Scramble
For more than a decade, serious flaws had gone undetected in technology underpinning much of the internet. It took artificial intelligence (AI) to bring them to light, and on Wednesday it caused a global cyber-security alert.
The vulnerabilities lie within a programming language called PHP, which has been used internationally since the 2000s to build websites. Governments and cyber-security agencies around the world scrambled to contain the fallout of the discovery, and urged website operators to install a new emergency fix or consider taking their platforms offline.
Cyber-security firm Wiz, one of the companies whose researchers uncovered the vulnerabilities, described the flaws as the most severe ever detected by AI. OpenAI, whose technology was used to find the flaws, called the discovery one of the most impactful security issues in recent memory.
Most people may not have heard of PHP, short for PHP: Hypertext Preprocessor, but they most certainly interact with it daily. PHP powers a vast number of platforms, including online shops, Wikipedia and WordPress, the content management system behind many websites such as blogs.
When you visit a website like Wikipedia, PHP is the code that collects the information you need and presents it in a way you can read on the web, Paul Spain, chief executive of Gorilla Cyber Security, told the BBC.
But due to a flaw that could allow attackers to take control of affected web servers without authentication and steal sensitive data, everything built on PHP was left exposed.
AI could make such attacks easier and faster, Spain said, estimating that the flaw could affect millions and millions of websites.
It would be disastrous if hackers or countries weaponised the flaw and seized private data from websites, said cyber-security researcher Jill Slay from the University of Adelaide.
The alert has disrupted services globally, from gaming platforms to government portals and online forums. That includes Wikimedia, the organisation behind the online encyclopaedia Wikipedia, which took down a number of its systems as a precautionary measure.
Sites and pages have been taken offline by the Finnish government, Edinburgh council and the BBC, with the Netherlands' cyber-security agency also pulling its website. Websites like the University of Geneva's were taken offline on Wednesday, and a number of Scotland's public organisations, including councils and health boards, have also taken their websites offline.
Experts warn the risk remains until the emergency fix is installed. In the coming days, the first task for website operators will be to check whether their platforms run on an affected version of PHP and to apply the fix quickly.
