This should have been a good news storypublished at 08:25 BST

08:25 BST

Joe Tidy
Cyber correspondent

The fact that researchers used frontier AI models to discover as yet hidden flaws should have been a good news story.

Researchers at Calif, Wiz and OpenAI used the best version of ChatGPT to uncover a method of attack that they said was "a complex chain of steps, at the edge of what human researchers could practically achieve".

They then worked together to come up with a way to fix it to make PHP better.

The security patch was due to be announced and rolled out in the normal civilised way patches usually are.

Then it all went wrong.

In the words of PHP Foundation, "coordinated disclosure of these vulnerabilities worked well" until two days ago.

Someone leaked some basic details about the potential flaws and hackers started trying to figure out how to exploit them.

Then, according to PHP Foundation, Calif accidentally posted a video about the hack.

Criminals immediately began coming up with methods and that’s what caused the rush and panic across the cyber world.

Image source, Reuters

Cyber-security firm Wiz estimates that "roughly 70%" of the internet is affected by the PHP flaws.

We haven't been able to verify that figure but here's what we can say about some of the websites that have reported issues around the globe.

• Amazon says it has detected an attempt by hackers to exploit the flaws but so far its websites are operating as normal
• The website of Dutch government agency the National Institute for Public Health and the Environment is currently down
• Another Dutch agency, specialising in cybersecurity, went offline as a precaution but is now running again

• Danish IT company Kombit shut down multiple services, including the national school communication platform

• Finland's government closed its public web services but is back online again
• Wikipedia also took down parts of its website

Osmond Chia
Business reporter

The scale of the PHP warning is hard to comprehend, but few cyber-security alerts have caused such panic.

The security concerns affect millions of web pages that run on PHP, potentially allowing a way for hackers to steal sensitive data or take control of websites.

The software powers platforms like WordPress - the content management system behind blogs and other text-heavy pages - Wikipedia and online shops.

That is why companies are racing to secure their platforms, while governments around the world urge websites to take action.

Image source, Getty Images

One of the world's largest intelligence agencies is warning that affected organisations should take their systems offline until a fix is in place.

In a post on X, the cyber division of the US National Security Agency says those using PHP should immediately prepare "for an update addressing two critical vulnerabilities".

It explains: "PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database.

"If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated."

The PHP flaws were initially found by humans back in 2024, Woodward tells Radio 4's Today programme, but they thought it looked "too complicated to exploit".

As large language models - a type of artificial intelligence (AI) - became more sophisticated, "people worked out how to exploit [the flaw]", the cyber security professor says.

"People have been scrambling away saying: 'Actually, yes, you can exploit it and we now need to patch it'," Woodward explains.

Part of the problem is that "the cat was let out of the bag rather earlier than it was supposed to have been," he says, adding that somebody revealed the PHP flaws before the patch - an update to fix the issue - was made public.

Asked whether it has led to hacking attempts, Woodward says companies like Amazon and Cloudflare that monitor what is going on online saw the weakness "was being probed for".

He adds: "We don't know whether [sites have] been attacked but certainly people were probing websites to see: have you got that flaw?"

The cyber-security flaws identified in the PHP programme language mean an attacker can "get their own code onto the web server" and "basically do whatever they like", says Alan Woodward, professor at the Surrey Centre for Cyber Security.

He tells Radio 4's Today programme this could include things like stealing personal data, going to other parts of your network, or planting a backdoor to gain access later on.

Referencing the "serious" scale of it, he says it could affect "something like 30 million websites".

Image source, PA Media

As we reported earlier, the UK government says it is working to identify any potential exposure in its online services.

A UK government spokesperson urges "all organisations, private and public, large and small" to follow guidance to protect their systems.

The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia, earlier urged those who use PHP to apply the fixes.

"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC said in a note, external.

The vulnerabilities were found by researchers at the security firms Calif and Wiz.

The researchers used advanced artificial intelligence (AI) tools that are able to analyse code and find flaws much faster than humans or older systems can.

"Modern software is incredibly complex, and some vulnerabilities can remain undetected for years," cyber-security researcher Salil Kanhere from UNSW Sydney says.

"The underlying bugs weren't new; what changed was our ability to find them," he adds.

Details of the discovery leaked online this week, forcing the PHP platform's developers to rush out its announcement of the security flaw and its huge scale.

The incident "highlights how AI can uncover security flaws" but also how it can "help attackers rapidly develop offensive tools and exploits," OpenAI - the maker of ChatGPT - says in a blog post.

Image source, Reuters

You may not have heard of PHP - short for PHP: Hypertext Preprocessor - but you almost certainly interact with it daily.

PHP powers a vast number of platforms, including online shops, Wikipedia and WordPress – the content management system behind many websites like blogs.

When you visit a website like Wikipedia, PHP is the code that collects information you need and presents it in a way you can read on the web, Paul Spain, chief executive of Gorilla Cyber Security, tells the BBC.

But due to a flaw that could allow attackers to take control of affected web servers without authentication and steal sensitive data, everything built on PHP was left exposed.

AI could make such attacks easier and faster, Spain says, estimating that the flaw could affect "millions and millions" of websites.

Image source, EPA/Shutterstock

Governments and some of the world's biggest companies, including Amazon, are rushing to protect their systems after the discovery of critical cyber-security flaws.

They are present in the PHP programming language that underpins a significant number of websites, with cyber-security firm Wiz estimating that "roughly 70%" of the internet is affected, though the BBC is unable to independently verify that figure.

Various European nations have shut down some public web services as a precaution, and Wikipedia also took down parts of its website.

This was in line with advice issued by governments, including the US, to take websites down if the flaws could not immediately be fixed.

Wiz - one of the companies whose researchers uncovered the vulnerabilities - describes the flaws as the "most severe" ever detected by AI.

OpenAI, whose technology was used to find the flaws, calls the discovery "one of the most impactful security issues in recent memory".

The UK government says it is working to identify any potential exposure.

Stay with us as we bring you the latest developments on this story.