What is PHP and why did it spark a global cyber-security scramble?

A set of serious flaws in PHP has triggered a global security scramble after researchers used AI to uncover bugs that had reportedly gone unnoticed for years. PHP has been around since the 2000s and sits behind a huge slice of the web, from online shops to Wikipedia and WordPress sites.

The risk is blunt. Attackers could use the flaws to take control of vulnerable web servers without logging in, then steal sensitive data. Paul Spain of Gorilla Cyber Security said that makes almost anything built on PHP exposed, and he warned the problem could touch “millions and millions” of websites. Jill Slay of the University of Adelaide called the prospect of hackers or countries weaponising it “disastrous.”

The fallout was immediate. Wikimedia took down a number of systems as a precaution, while the Finnish government, Edinburgh council, the BBC and the Netherlands’ cyber-security agency all pulled sites offline. Across Scotland, councils and health boards also took websites down. Smaller organisations with weaker security teams may be especially exposed, experts said.

PHP’s developers pushed out patches on Wednesday and told users to update immediately. US National Security Agency advice was unusually stark: if organisations could not patch straight away, they should take systems offline. The UK’s National Cyber Security Centre, along with counterparts in the EU and Australia, issued similar warnings, and Japanese Prime Minister Sanae Takaichi urged people to check whether their public sites run on PHP.

The discovery also cuts both ways for AI. The researchers at Calif and Wiz used advanced AI tools to analyse code far faster than humans or older systems, and OpenAI said the episode shows how AI can expose security holes while also helping attackers build exploits more quickly. The bugs themselves were old; the difference was that machines could finally spot them at scale.