AI-Found PHP Flaw Forces Governments to Pull Websites Offline
Two critical flaws in the PHP programming language, uncovered with the help of artificial intelligence, allow an attacker to run commands on a web server without any password. America’s National Security Agency told organisations to patch at once or take systems offline. Britain’s budget watchdog took its own website down.
The flaws, together dubbed PHP2Shell, had sat in the code for more than a decade and were found by two security firms using large language models. The response has been precautionary and very wide: the National Cyber Security Centre told British organisations to consider taking systems offline and to check for “backdoors installed by an attacker”, and the Office for Budget Responsibility pulled its website down — a week before it publishes its forecast alongside the Budget. NHS Scotland went dark; at one point seven of Scotland’s 32 councils and six of its 14 health boards were offline, and six councils still report problems with payments. Edinburgh, Bristol and Oxford councils, the Paris police prefecture and the Dutch national digital identity service all went down. Amazon found an exploit attempt against a decoy server on 17 October, four days before public disclosure. But the distinction that matters has been drawn by the people best placed to overstate it. The researcher who found the flaw called it the most serious he had ever seen, then added: “it doesn’t look like exploitation has taken off or been widespread.” Attempts are not breaches.