In brief
Artificial‑intelligence researchers found a severe flaw in PHP that lets attackers control web servers without login. The bug, hidden for years, forced governments, major websites and even Amazon to act fast. Patches rolled out overnight, but many sites went offline to protect data. The incident shows how AI can both reveal and accelerate security risks. Web owners must update PHP immediately and stay alert for phishing.
What’s PHP and why it matters
PHP is a scripting language that powers big sites like Wikipedia, WordPress blogs, and many online shops. It runs behind the scenes, pulling data from databases and showing it to users. Because it’s so widespread, a bug in PHP can affect millions of sites worldwide.
The AI‑discovered flaw
Security researchers at Wiz and another firm used advanced AI tools to scan PHP’s code and found a serious vulnerability that lets attackers take control of a server without logging in. The bug could let them steal data or redirect traffic, turning a site into a tool for phishing or ransomware.
What’s been affected
The alert hit governments, gaming platforms, news sites and even national institutions. Edinburgh Council and the BBC pulled sites offline as a precaution, and the University of Geneva shut its website down. Amazon already experienced attack attempts just days before the public disclosure.
Global response
PHP developers released patches on the same day. The US NSA urged all U.S. agencies to patch or temporarily disable affected sites, and the UK’s National Cyber Security Centre warned about potential backdoors. Even Japan’s prime minister posted on X telling people to check if their public sites run PHP.
How AI found the flaw
AI can scan millions of lines of code far faster than humans and spot subtle bugs that stay hidden for years. The same tools, if weaponized, could create new exploits more quickly. This dual‑use nature drives the need for tight patch management.
What you can do
If you run a website: update to the latest PHP version right away. Watch security bulletins and consider temporarily shutting down sites if patching takes time. Users should stay alert for phishing emails that use the story for lures and change passwords on services that had PHP backbones.
In a nutshell: AI helped expose a 10‑year‑old bug, governments scrambled, and everyone with a PHP site is under pressure to patch fast—otherwise they might just be the next target.
