Critical PHP flaw found by AI takes government sites offline worldwide

· Cybersecurity · United States

Government websites in Europe and elsewhere went offline on Oct 21 after researchers disclosed critical vulnerabilities in PHP, the programming language used by roughly 70 percent of websites. The flaw would let hackers take control of vulnerable servers without a password, prompting operators worldwide to shut sites down while they applied patches. The PHP Foundation issued updates and said the first signs of the problem had been identified in 2024; the discovery was described as the most significant ever found by AI. A fix was deployed, but the episode showed how quickly a single flaw in shared open-source software can ripple across the internet's infrastructure.

Why it matters：One flaw in ubiquitous open-source software took down government services across continents, highlighting the fragility of the internet's shared foundations and the growing use of AI to find security holes.

Key points

  • PHP is used by about 70 percent of websites, making the flaw unusually far-reaching.
  • The PHP Foundation said early signs of the issue date to 2024.
  • Operators shut sites down rather than risk takeover of vulnerable servers without a password.

Sources (original reporting)

More stories from this day