PHP Flaws Found by AI: What Websites Need to Know

Artificial intelligence has helped uncover critical security flaws in PHP, a widely used programming language, and many websites went offline on Thursday, October 22, as organisations around the world rush to protect their systems.

What Is PHP?

Created in the early 1990s, PHP helps run an estimated 70 per cent of the world’s websites, and underpins popular web design platforms, from online stores to government services. Security firm Wiz Research, which says it used AI to find vulnerabilities that had been hidden for more than a decade, called it “a backbone of the web”.

The Fix

A fix was released on Wednesday. The PHP Foundation told organisations: “If you run PHP, it is imperative that you update now.” The flaws were found with cutting-edge AI models in August and kept confidential while the fix was developed. Another security firm also found them in a separate audit.

Are Sites Being Hacked?

Experts stress that taking a website offline does not necessarily mean it has been hacked, and can be a responsible step while updates are applied. Security researchers say they have so far seen no evidence of active attacks using these techniques.

Remaining Risks

• Large institutions should be able to patch quickly, but smaller sites, including user-run blogs, may remain vulnerable for days or weeks if their owners do not know about the issue.

• Because online systems often rely on third-party interfaces, some vulnerabilities could persist even after a site is patched if those third parties still run unpatched PHP.

• Experts advise layered defences rather than relying on a single fix.