Symbolic imageWebsites go offline worldwide as PHP releases fixes for critical flaws
Two critical flaws in PHP, used by up to 70% of websites, led agencies and firms to take sites offline on Wednesday. The developers released fixes that afternoon.
On Wednesday, 21 October, governments in Germany, France, the Netherlands, Belgium and Finland pulled sites, including Germany's Interior Ministry and the Dutch DigiD login service, and the Wikimedia Foundation took down several systems. The US NSA, Germany's BSI and Britain's NCSC had advised patching at once or going offline. PHP's developers published fixes shortly before 16:00 German time, and tech firms warned that some hackers were already exploiting the flaws.
Found with AI
Wiz says it found the flaws with an AI research tool and models from Google and OpenAI; Calif says a language model helped it on 1 August. OpenAI claims frontier AI was key, but the researcher says they used public models (Guardian). Le Monde, citing the Wall Street Journal, says the fix was planned for Thursday, 22 October, until a Hacker News post forced an earlier release.
Race to exploit
Experts expect a wave of intrusions since the fix is public and AI can reverse engineer it. Costin Raiu of TLP:Black predicts mass compromise of vulnerable servers; Alan Woodward of Surrey University expects weeks or months of attacks on poorly maintained sites.