London (Web Desk): Two serious security vulnerabilities have been discovered in PHP, a programming language used to run a large number of websites worldwide. Following the discovery, governments and cybersecurity agencies in various countries have instructed website operators to take immediate protective measures.
Cybersecurity experts have warned that organisations unable to issue or install security updates immediately should temporarily shut down their websites as a precaution. In response to the situation, several organisations, including the Finnish government, Edinburgh City Council and British broadcaster the BBC, have temporarily taken some of their online services offline.
The security vulnerabilities were discovered with the help of artificial intelligence. According to cybersecurity company Wiz, they rank among the most serious security flaws identified to date using AI technology. Experts say artificial intelligence is rapidly transforming the field of cybersecurity.
Finland has temporarily shut down its public government web services, while the Netherlands’ cybersecurity agency has also confirmed that its website was taken offline because of the risks.
The US National Security Agency has also advised organisations to temporarily shut down affected systems if they cannot immediately implement security updates. There are concerns that the vulnerabilities could allow attackers to gain direct access to servers’ file systems or databases.
According to the White House, federal agencies are accelerating efforts to address the issue in collaboration with leading artificial intelligence companies. Japanese Prime Minister Sanae Takaichi has also urged public institutions and relevant organisations to check whether their websites use the PHP programming language.
The Wikimedia Foundation, which operates the online encyclopaedia Wikipedia, has said it is taking protective measures to address the vulnerabilities. According to the foundation, some other systems have also been temporarily shut down as a precaution and will be reactivated once they can be securely updated. The situation caused some users to experience difficulties accessing certain parts of Wikipedia.
Edinburgh City Council’s website was also affected, while the websites of some BBC programmes, including Doctor Who and The Traitors, were temporarily unavailable. However, the affected organisations have not yet confirmed that their service disruptions were directly caused by the PHP security vulnerabilities.
Some other websites, including the art platform DeviantArt, also announced temporary outages but did not clarify the reasons behind them.
The vulnerabilities were discovered by experts at cybersecurity companies Calief and Wiz. The research was conducted under OpenAI’s “Patch the Planet” programme, which provides experts with advanced artificial intelligence tools to identify and fix vulnerabilities in programming languages used in web development.
In a blog post, OpenAI described the discovery as one of the most significant security issues in recent years. According to the report, the vulnerabilities had remained undetected for more than a decade, but experts managed to discover them within just a few weeks of using advanced AI tools.
Wiz estimates that a large number of websites using PHP could be affected by the threat, with the issue potentially having some degree of impact on approximately 70 per cent of the internet.
The PHP Foundation had planned to publish details of the vulnerabilities and release security patches towards the end of this month. However, information about them was leaked on social media on Tuesday. Following the disclosure, immediate protective measures became essential for affected organisations.