PHP flaws spark global cyber security scramble as websites go offline

A widely used platform at risk

Wiz called the vulnerabilities the “most severe” ever detected by AI. Spain said AI could make attacks easier and faster, and estimated the flaw might affect “millions and millions” of websites.

Services taken offline

The alert disrupted services around the world, including gaming platforms, government portals and online forums. The Finnish government, Edinburgh council and the BBC took sites or pages offline; the Netherlands’ cyber-security agency also withdrew its website.

The University of Geneva’s website was taken offline on Wednesday. Councils, health boards and other public organisations in Scotland also temporarily took their websites offline.

Patches and official warnings

PHP developers released patches on Wednesday to address vulnerabilities that had remained in the software for years. Details of the discovery leaked online this week, prompting the developers to announce the flaw and its scale.

Authorities and security organisations urged website operators to secure their platforms. The US agency said the risks required immediate patching across government departments and agencies; counterparts in the EU and Australia issued similar alerts. Japan’s Prime Minister Sanae Takaichi urged people to check whether their public websites used PHP.

More attacks may follow

Salil Kanhere, a cyber-security researcher at UNSW Sydney, said further attempts to exploit the flaws were likely in the coming weeks now that technical details were public. He also noted that complex modern software can contain vulnerabilities for years without detection.

The ChatGPT-maker said it had released a program to check PHP security. Website owners are being urged to install the latest PHP version, apply patches promptly and watch for phishing messages that exploit publicity around the incident.