AI uncovers critical PHP flaws; government websites go dark worldwide including EU states

Governments and companies shut down websites on Thursday after artificial intelligence tools uncovered two critical security flaws in PHP, the programming language that runs approximately 70 percent of the world's websites, according to Wiz Research, one of the cybersecurity firms that identified the vulnerabilities.

PHP programmers released a fix on Wednesday, and the US National Security Agency told organisations to patch immediately or take vulnerable systems offline. The EU echoed that call, as did authorities in Japan. A platform affiliated with China's Ministry of Industry and Information Technology warned of "two critical remote code execution vulnerabilities with severe impact" in PHP.

Government agency websites in countries including Australia, Finland and the Netherlands went dark, while insurance firms, transport operators and media outlets entered emergency maintenance. The Wikimedia Foundation warned users they could see outages while it addressed the flaws. A Pokémon sleep tracker was also temporarily taken offline.

A Wiz blog post said the findings rank "among the most severe vulnerabilities discovered in PHP, and arguably in software history."

Rahat Masood, senior lecturer in cybersecurity at the University of New South Wales, Sydney, said the flaws could allow attackers to access servers "without any authorisation, without any username or password" and do "anything they want" once inside, including stealing data or modifying content.

Volker Dusch, a security engineer at the PHP Foundation, told the Wall Street Journal it was the most serious problem PHP had faced in more than a decade.

Only sites running PHP on their own servers are exposed. Many large platforms built on other languages, or using operators able to deploy the fix quickly, stayed online.