Government websites across Europe shut off after PHP bug revealed

Websites across the world, including some governmental sites, went offline on Wednesday after a bug in the common PHP coding language was revealed, the latest in a series of AI-discovered flaws.

The critical vulnerability was discovered by Alphabet-owned cloud security firm Wiz, which said that it would allow malicious actors to take control of affected servers, steal sensitive data and deface the websites running on them. The bug had been hiding in the codebase of core PHP, which powers more than 70 per cent of the internet, for over a decade.

Although the underlying flaws had existed for a long period, it added the steps taken to exploit them were so complex that they sat at “the edge of what human researchers could practically achieve”, Wiz said. Frontier AI models are what enabled this to become an actual exploit, the company added.

Wiz worked in coordination with the PHP Foundation, OpenAI and fellow cybersecurity firm Calif. PHP released updates to fix the bug on Wednesday, prior to its disclosure.

The vulnerability has prompted rapid responses from governments, cyber security agencies and major companies around the globe. A UK government spokesperson urged “all organisations, private and public, large and small” to protect their systems, according to the BBC.

Security agencies including the UK’s National Cyber Security Centre, the EU’s Enisa, and Australia’s Cyber Security Centre issued warnings urging users to immediately update their systems that run on PHP, and consider taking internet-facing ones offline until they are patched if this isn’t possible.

Even before the bug’s disclosure, some major companies reported attempts to exploit it. Amazon’s security chief CJ Moses said on Wednesday that its security team detected an attempt to hack one of its decoy “honeypot” systems on 17 October.

Cloud services firm Cloudflare’s chief executive Matthew Prince said in an X post that “In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it”.

This is the latest, and largest, major cyber vulnerability discovered by AI models, and is likely to add to the fears raised by governments and regulators in recent months after a series of high-profile hacks by frontier labs.