The US National Security Agency (NSA) has issued an urgent warning regarding two critical vulnerabilities discovered in PHP, a programming language powering approximately 70% of the world’s websites. These flaws, uncovered using AI tools from OpenAI and Google, had gone undetected for over a decade and could allow hackers to take control of servers without login credentials. The UK’s National Cyber Security Centre (NCSC) also urged immediate action, advising organizations to patch systems or take them offline.
The vulnerabilities were identified by researchers at Calif and Wiz, with Alphabet-owned Wiz confirming PHP’s widespread use. OpenAI stated that frontier AI found these flaws before attackers did, highlighting both the defensive and offensive potential of AI in cybersecurity. The release of advanced models from Anthropic and OpenAI earlier this year had already prompted regulatory scrutiny and temporary government limits on rollout.
PHP’s dominance is largely due to its integration with WordPress, the most widely used website-building platform. The White House confirmed federal agencies were assessing impacts on government systems and critical infrastructure. Developers released patches on Wednesday, but the NSA emphasized that immediate updates are essential to prevent exploitation.
Source: Financial Times Companies · Summarized by HeadlinesBriefing