Critical vulnerabilities were detected in a widely used computer language, prompting cybersecurity authorities to advise affected websites and apps go offline until a fix became available Cybersecurity experts around the globe are racing to update systems and prevent the most disruptive AI-enabled hack yet discovered. A flaw uncovered in widely-used code has made 70 per cent of websites worldwide vulnerable to data theft and defacement. Government websites in France, Denmark, Finland and the Netherlands were taken offline as a precaution when the news emerged.
PHP is a computer language commonly used in websites, but executed on a server. It’s used to power interactive websites such as the content management system WordPress, which runs news sites and blogs, social networks like Facebook and key reference tools like Wikipedia. The issue actually involves two flaws, both found by Israeli-American cloud security company Wiz.
They relate to how PHP handles errors involving memory: in certain circumstances data can be left behind after an error, which can then be accessed by a malicious actor. That data can include private information but it can also allow an attacker to run malicious code. Every PHP version released in the last decade is affected by at least one of these vulnerabilities, but the PHP Foundation that oversees development has already issued an update to overcome this.
The Foundation did not respond to a request for interview, but said in a blog post that signs of the vulnerability emerged in 2024. This is because there was no immediately obvious practical way for hackers to exploit it at the time, and because there was debate about which of several fixes was most appropriate. In 2024 the flaw was thought to be impractical to take advantage of, but Alan Woodward at the University of Surrey, UK, says AI has moved the goalposts of what is possible since then.
It requires millisecond timing,” says Woodward. But what AI does, it doesn’t go for tea breaks, it doesn’t go home at six o’clock: you can just set loads of them running and eventually they’ll come up with the right answer of how to exploit it.” Wiz said in a blog post announcing the discovery that there are probably further bugs along similar lines in the PHP code base, which developers will also need to identify and rectify. Wiz did not respond to a request for comment.
Independent cybersecurity expert Junade Alitold Science Media Centre that two thirds of websites use PHP and may be vulnerable to this latest technique. AI has grown extremely capable in the field of cybersecurity over recent months, which includes working out how to hack computers and how to defend them from hackers, creating a destabilising effect that is yet to reach an equilibrium. In April, news broke of an unreleased AI model created by Anthropic called Mythos, which the company had kept under wraps because it had been found to be extremely good at hacking.
Extract — continue reading at the source.
