AI Found Holes in PHP, Some Older Than Ten Years: Europe Is Shutting Down Government Websites

Some of the flaws had sat in PHP's code for more than ten years, in plain sight of developers, and nobody recognised how dangerous they were. It took artificial intelligence to find them. Now governments across Europe are shutting down parts of their websites, and the Wikimedia Foundation, which runs Wikipedia, has switched off a number of auxiliary services.

Most people have never heard of PHP, but they use it every day. It powers portals, online shops, government pages and systems like WordPress, on which millions of websites are built. According to the figures being cited, almost 70 percent of websites whose programming language is known use PHP. That doesn't mean 70 percent of the internet has been hacked. It means the problem sits in a technology that is everywhere.

The flaws are dangerous for a simple reason: under certain conditions, an attacker can run their own commands on a vulnerable server without a username or password. That opens the way to stealing sensitive data and changing a site's content. The second flaw can expose parts of the data the server holds in memory.

From Finland to Oxford

Finland preventively switched off some public online services, and institutions in the Netherlands took similar measures. In the UK, at least 32 government services are still unavailable, and four more are running with difficulties. The websites of some local authorities also went down temporarily, including Edinburgh and Oxford, as did parts of the BBC's online services. British authorities say key public services are not at risk. The shutdowns don't mean these institutions were hacked. They are a precaution.

The worse news is the timeline. Amazon Web Services detected attempts to exploit the vulnerability as early as 17 October, four days before the security patches were published. That means someone knew about the holes before the administrators did. How long they knew, and whether they have already managed to get in somewhere, nobody can confirm for now.

A double-edged sword

Experts from several companies took part in the discovery, with the help of AI models from Google and OpenAI. That is the good half of the story. The bad half is that the tool that helps defenders find and patch holes faster helps attackers exploit them just as fast. The race is no longer measured in months, but in days.

Ordinary users who are just browsing are not directly at risk. The problem is on the servers, and the patches have to be installed by website owners and their hosting providers. The real danger for citizens is the fake messages that will try to exploit the fear to steal passwords. Croatia's national CERT has already issued an urgent warning to administrators. Has anyone in Macedonia's institutions already checked their servers - and would we even find out if they haven't?