In brief
A deep‑learning model spotted a long‑standing flaw in the PHP coding language that lets remote attackers seize control of servers without authentication. The bug, affecting millions of sites from Wikipedia to online retailers, triggered a worldwide cyber‑security scramble as governments urged rapid patching. PHP developers released a new update the same day the flaw was publicised, and agencies from the US and UK advised immediate action. The incident underlines how AI can both expose hidden vulnerabilities and accelerate the spread of malicious exploits.
A software bug that had slept for years in the popular PHP programming language has been uncovered by an artificial‑intelligence system, triggering a worldwide cyber‑security alert.
The flaw lets hostile actors take control of affected servers without needing any login details, and may compromise databases that power millions of sites – from Wikipedia to online shops.
What the flaw looks like
PHP – short for Hypertext Preprocessor – is the backbone of countless sites. Researchers at Wiz and a firm called Calif discovered that an old coding practice in the language could give attackers a backdoor into the system.
The issue was only spotted because AI automatically scanned source files at speed far beyond human reach.
Affected sites and services
Governments, game publishers, educational institutions and news organisations have gone offline or applied the patch immediately. The University of Geneva and several Scottish council sites pulled their pages, while the White House and the UK National Cyber Security Centre confirmed the risk for government systems.
Official response
PHP developers issued a security update on the same day the vulnerability was made public. The United States National Security Agency called for all PHP users to install the fix without delay and to monitor for signs that the backdoor had been already inserted.
The UK’s National Cyber Security Centre supplied similar advice and urged companies to look for 'signatures of backdoor activity'.
Why AI was key
The discovery was enabled by OpenAI tools that analyse millions of lines of code, finding subtle mistakes that would normally stay hidden for years. The same AI can help attackers write exploits once a flaw is known.
What site owners can do
Upgrade to the latest PHP version immediately – the patch is small but critical. Keep a copy of the old code before changing, and verify that no malicious file has been added.
If you run a public site, make sure your users are notified of the patch and watch for phishing attempts that tie into the story.
