Menu
SUBSCRIBE
SUBSCRIBE
Menu

AI vulnerability discovery

Close-up of colorful PHP code in a dark code editor, for an article on critical PHP flaws found with AI

Governments And Companies Take Websites Offline After AI Finds Critical Flaws In The Language Behind 70% Of Websites

, , , , , , , , , , ,

The flaws let attackers take over web servers without a password. Cloudflare alone counted millions of attempts to exploit them within hours of their disclosure.

 

Governments and website operators around the world took sites offline after researchers using AI found flaws in PHP, the programming language behind roughly 70% of all websites, that let attackers take over servers without logging in.

Attackers began trying to exploit the flaws as soon as they became public. Cloudflare, which filters traffic for about 28% of all websites, said it counted tens of thousands of attempts to exploit the flaws within 45 minutes of PHP disclosing the vulnerabilities, and millions within hours.

Amazon said one of its decoy servers, which are set up to attract attackers, recorded an attempt on Oct. 17, four days before the flaws were made public. Amazon said it is unclear how the attacker got the details before disclosure.

Amazon said it is unclear whether the attempts it recorded would have worked against real systems. No successful break-in has been confirmed as yet.

The Cybersecurity and Infrastructure Security Agency (CISA) confirmed that it hasn’t seen the flaws exploited as of Oct. 21. The PHP Foundation, the nonprofit that funds PHP’s developers, also said it had found no working attack code when the fix was released.

CERT-EU, the cybersecurity team for EU institutions, was less certain: it said attack code circulating online “raises the likelihood that attackers are already exploiting the vulnerabilities,” but stopped short of confirming a breach.

Sites went offline from Europe to Australia

News of the flaws leaked online on Oct. 20, a day before PHP’s developers planned to release a fix. Rather than wait, governments, companies, and nonprofits took sites offline as a precaution. Those that went offline included:

  • Netherlands: DigiD, the national login for government services, along with the MijnOverheid government portal, the parliament’s website, and the NCSC’s own site. Broadcaster RTL’s news site and app and Amsterdam Schiphol Airport’s app were also affected.
  • Belgium: all Flemish government websites, temporarily.
  • France: the Interior Ministry took down local government prefecture websites.
  • Finland and Australia: government agency websites.
  • Wikipedia: the Wikimedia Foundation, which runs it, took many of the tools its volunteer developers use offline while working to keep Wikipedia itself running.

Some sites, including DigiD and MijnOverheid, were back online by the evening of Oct. 21, while others stayed offline longer.

The National Security Agency told organizations to install PHP’s fix immediately or take vulnerable systems offline, according to AFP. Authorities on three continents issued similar calls, including CISA, the FBI, CERT-EU, Japan’s prime minister and a platform affiliated with China’s Ministry of Industry and Information Technology.

Any unpatched PHP site can be taken over without a password

PHP runs on web servers and builds the pages visitors see. WordPress, Drupal, Joomla, and MediaWiki, the software that runs Wikipedia, are all written in PHP.

The flaws are in PHP itself, not in the websites built on it, so a site with secure code can still be exposed. Wiz, a cloud security company owned by Google, showed that an attacker who never logs in could run their own commands on servers running the latest versions of WordPress, Drupal and Joomla.

Wiz also showed that an attacker could read data from a server’s memory without taking over the server. That data can include passwords, login tokens and API keys, both the server’s own and those sent by other people using the site.

PHP’s security team tracks the problems as two flaws and rated both 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS), the scale security teams use to rank how dangerous a flaw is. Wiz says every PHP version released in the last decade has at least one of them.

Two teams found the flaws with AI, weeks apart

Calif, a California security firm, found the first flaw in August using OpenAI’s GPT-5.6 Sol model. It was auditing PHP’s code under Patch the Planet, an OpenAI program that pays for security reviews of widely used open-source software.

Wiz found both flaws on its own on Aug. 19, using Google’s Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas research tool. It reported them to PHP’s developers on Aug. 24.

AI turned a flaw too complex for humans to exploit into a one-week job

Wiz said AI is what turned the flaws into a working attack. The flawed code had been in PHP for more than a decade. Before AI, building a working attack from these flaws was so complex that Wiz called the work “at the edge of what human researchers could practically achieve.” An attacker had to combine several flaws, then retest and adjust the attack on each server, because each one handles memory differently. Wiz said AI models can now do that retesting and adjusting themselves. A single researcher built the working attack in a week using the AI models Wiz mentioned. Wiz said before AI the attack would have taken “a world-class team months” to create.

PHP’s developers say updating is the only complete fix

PHP’s developers released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21. Versions 8.1 and older no longer get official updates. The developers posted fixes that technical teams can apply themselves to versions 7.4 through 8.1, and some Linux distributors and other vendors supply updates for older versions.

Cloudflare, Amazon Web Services, Microsoft, Google, Akamai and other providers set up filters to block attack attempts before they reach a customer’s server. PHP’s developers say these filters block some attack methods, but only installing PHP’s fixed versions closes the flaws.

AI has been finding software flaws in large numbers

In June, the UK government said it found 407 security flaws using the most powerful AI models. Companies in Anthropic’s Project Glasswing, which gives vetted organizations access to its most powerful models to find and fix software flaws, found at least 129,000 software flaws between April and July.

OpenAI said the PHP flaws are among several serious vulnerabilities it has already found and is working to fix. It expects similar findings “to increase sharply in the coming months.”

Teal light streaks racing down a digital tunnel, on BSA's plan to give defenders first use of AI cybersecurity models

BSA Proposes Giving Cyber Defenders Early Access to Powerful AI Models

, , , , , , , , ,

Qualified organizations would use the models to find and fix security flaws before those capabilities become broadly available.

 

The Business Software Alliance (BSA), an enterprise software trade group, proposed giving trusted cybersecurity organizations early access to powerful AI models before releasing them more widely.

Under the proposal, governments, AI developers, and cybersecurity organizations would form a voluntary partnership to oversee these phased releases. BSA’s announcement did not name a government body to run the partnership, any AI developer that had agreed to participate, or a timetable for creating it.

Defenders would get a head start

The proposal would apply to the most powerful AI cybersecurity models, which BSA said can find security flaws, determine which are most urgent, and exploit them with limited human direction. BSA cited GPT-6 Astra and Mythos as examples but did not say exactly how capable a model would need to be to qualify for the program.

BSA said the same capabilities can help defenders identify weaknesses more quickly or help attackers exploit them. Its proposal would give selected defenders time to locate vulnerabilities and coordinate fixes before attackers gain broad access to the models.

The early users would include cybersecurity providers, software companies, critical infrastructure operators, and organizations working to secure widely used open-source software. BSA also wants to deploy these capabilities more broadly through security platforms that organizations already use. The proposal says the partnership should eventually support both organizations protecting their own systems and providers protecting their customers, but it does not explain how that wider rollout would work.

BSA sets tests for early access

Organizations would need more than cybersecurity experience to qualify. BSA said applicants should show that they have followed applicable laws and accepted practices for reporting and fixing security flaws. The partnership would also examine whether they have the people and resources to use the models effectively and whether their work protects critical infrastructure or widely used technologies. BSA did not say what evidence applicants would need to provide. 

Applicants would also need to show that they could prevent unauthorized access to the models. They would have to disclose who owns or controls the organization and identify any other parties with substantial influence. The partnership would also consider whether the organization has ties to a country of concern that could make granting access risky.

Priority access would be temporary

The proposed partnership would first decide which AI models are powerful enough to require a phased release. Most AI security tools would remain outside the program because they do not materially expand what cybersecurity teams can already do.

The restricted-release period would end once similar models became widely available or the security risks no longer justified limiting access. BSA said participants should know the expected length of the early-access period, but its proposal does not set a maximum duration.

The full proposal also calls for clear application rules and explanations when an organization is denied access. It does not specify who would make those decisions or what steps governments and AI developers will take next to establish the partnership.