---
title: "Critical PHP Vulnerabilities Discovered by AI Technology"
url: https://noti.group/critical-php-vulnerabilities-discovered-by-ai-technology/
language: en
publisher: "Noti Group"
section: "Technology"
published: 2026-10-21T15:47:13.000Z
updated: 2026-10-21T16:44:17.897Z
id: 16643b92-c024-4da0-988a-67a3e18eebac
source: "BBC News Technology https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o?at_medium=RSS&at_campaign=rss"
attribution: "Link to https://noti.group/critical-php-vulnerabilities-discovered-by-ai-technology/ and name Noti Group when you quote or summarize this story."
---

# Critical PHP Vulnerabilities Discovered by AI Technology

Websites around the world have been taken offline as governments and cyber-security agencies issue a critical update to address two severe vulnerabilities in the widely used PHP programming language.

The flaws were discovered by artificial intelligence (AI) technology, which is revolutionizing the way cyber threats are identified and addressed. According to Wiz, a leading cyber-security firm, these vulnerabilities represent the most severe ever found using this type of tech.

Multiple countries have taken drastic measures to mitigate the risks posed by these vulnerabilities. The Finnish government has temporarily shut down its public web services, while the Netherlands' cyber-security agency has also taken its website offline. Similarly, Edinburgh council in Scotland and the BBC have removed their online content from public access.

The US National Security Agency (NSA) has issued similar guidance to organizations that are struggling to apply the necessary fixes in time. The NSA warns that these vulnerabilities provide a direct path to a server's file system or database, making them extremely potent.

Several high-profile websites have been taken offline as a result of critical cyber-security vulnerabilities being discovered. Edinburgh council's website is among those affected, along with online platforms for popular BBC programmes such as Doctor Who and The Traitors.

It has not yet been confirmed whether the outages are related to PHP, but BBC News has reached out to those involved for comment. Some websites, including art platform DeviantArt, have stated that they are experiencing technical difficulties due to "temporary maintenance without providing further details.

The vulnerabilities were identified by cyber-security researchers at firms Calif and Wiz using state-of-the-art AI technology provided by OpenAI. In a blog post, OpenAI described the issue as one of the most impactful security issues in recent memory", suggesting its severity is significant.

According to the research teams, these vulnerabilities have gone undetected for more than a decade, affecting an estimated 70% of internet users, although this figure has yet to be independently verified. The scale and longevity of the issue highlight the need for swift action to prevent further exploitation.

The Netherlands' National Institute for Public Health and the Environment has taken its website offline in response to the situation, as have other government agencies such as the Tweede Kamer's lower house of parliament. Cyber-security authorities worldwide, including those in the UK, EU, and Australia, are urging PHP users to apply necessary fixes to mitigate the risk.

The widespread use of PHP in various online platforms is making it challenging for organizations to identify and address the vulnerabilities.

PHP powers numerous popular content management systems such as WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and even some software that does not explicitly mention its reliance on PHP.

Cyber-security experts are warning that hackers may target these vulnerable systems, which could potentially lead to unauthenticated remote code execution and allow attackers to install malware.

This type of cyber-attack could have severe consequences, including the ability for hackers to take down websites entirely.

Organizations are advised to be vigilant in identifying signs that an attacker may have already gained access to their system.

Organizations that have already installed the critical cyber-security update are advised to remain vigilant in monitoring their systems for potential security threats.

This is because attackers may still attempt to exploit vulnerabilities in older versions of PHP, which could allow them to gain unauthorized access to a system. The latest update has been issued specifically for the most recent versions of PHP, with users of earlier versions being urged to upgrade to prevent potential security risks.

PHP 5 and all subsequent versions are potentially affected by this vulnerability, according to CERT-EU, which notes that PHP 5 was first released in 2004. However, it's worth noting that only the latest versions of PHP - those running PHP 8.1 or later - will receive the update from the PHP Foundation.

As online threats continue to evolve, King warns that malicious actors are adapting their tactics to evade detection and exploit vulnerabilities in software.

---
Source: [BBC News Technology](https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o?at_medium=RSS&at_campaign=rss)  
Published by Noti Group: https://noti.group/critical-php-vulnerabilities-discovered-by-ai-technology/