AI-found flaw in PHP pushes government and other websites offline

Sites go dark across borders

As The Independent on MSN reported, UK cyber security chiefs warned organisations that they might have to pull their websites offline after a researcher found a "critical security issue" in PHP. The effects showed up on Wednesday. Part of the Finnish government's website was disabled, and so were sites run by several UK local authorities.

Oxford City Council and the City of Edinburgh Council both took their sites down, and some BBC programme pages stopped loading. The Office for Budget Responsibility said it had gone offline because it was following official guidance on the PHP problem.

Some UK government online services may be briefly unavailable while fixes are applied. The expectation is that disruption will be small, and no big public-facing essential services are thought to be affected.

Why one language can shake so much

PHP is a programming language that works behind the scenes on web servers, the computers that store a site and send it to your browser. Cloudflare, a company that helps protect websites, says almost 70% of websites use it. It also sits underneath popular platforms such as WordPress and Magento.

According to the report, the flaw could let an attacker take remote control of any web server running PHP. The cyber arm of the US National Security Agency warned that weaknesses like this could give attackers a direct route to the server's files or database.

That scale explains the drastic response. When so many sites share the same building block, one hole can sit under thousands of unrelated organisations at once.

A race measured in minutes

Cloudflare's chief executive, Matthew Prince, shared figures on X under the tag #php2shell. In the 10 hours before the public announcement, Cloudflare's network saw thousands of attempts to use the flaw. Within 45 minutes of the announcement that rose to tens of thousands, then hundreds of thousands within 2 hours, and he said it was in the millions by the time he wrote.

Those numbers show the danger window: the time between a flaw becoming public and a site being fixed. Attackers do not need to be clever to exploit it, only quick.

The UK's National Cyber Security Centre (NCSC) urged organisations to move to the new, fixed version of PHP. Those unable to update straight away were told to consider taking their sites offline until they can.

AI on both sides of the lock

The Wall Street Journal reported that Ryan Austin, a researcher at the security firm Calif, found the flaw in August using an advanced AI model from OpenAI. PHP's maintainers had reportedly planned a fix for Thursday, but brought it forward after details of their work leaked online.

OpenAI said it led a group of researchers over the past two months to deal with the problem and supported PHP's developers in building the fixes. It called the episode "one of the most impactful security issues in recent memory". It also said AI can help attackers as well as defenders, and that in its view the AI found these flaws before attackers did, giving defenders a head start.

That head start was clearly short. The leak and the surge in attempts show how fragile such a lead can be.

What it could mean for ordinary people

Ciaran Martin, a former head of the NCSC, told Times Radio the flaw could lead to a significant loss of personal data. He raised the possibility of stolen card details, including the three digits on the back, and said people should watch for scams in the coming weeks.

He added that ransomware criminals, who lock up an organisation's data and demand payment, could not use the flaw to launch ransomware directly. But it could give them a foothold inside a network. Knowing more about a company's leaders would also make impersonation easier.

• Expect some sites to be briefly unavailable while fixes go in.
• Be wary of unexpected messages that mention your cards or accounts.
• Site owners should check that their host has installed the fixed PHP version.