International governments and agencies have urged websites to address two critical cyber-security flaws in a programming language which powers much of the internet.
The vulnerabilities were found within the PHP programming language, with a fix issued on Wednesday afternoon.
Where fixes are not possible, companies have been urged to take down sites.
It is important that any business with issues contacts their web developer.
Many people will have had emails from their web companies with a reassuring messages that corrective action has been takem.
What happened?
On Wednesday October 21, two critical cyber-security flaws in a programming language which powers much of the internet were discoved.
The BBC reported that the flaws were discovered by AI, with cyber-security firm Wiz saying they were the “most severe vulnerabilities ever discovered” by the tech, which is reshaping the cyber landscape.
Finland temporarily shut down the government’s public web services, while the Netherlands’ cyber-security agency said it was taking its own website offline due to the vulnerabilities. Similar problems were seen around the world with organisations including the BBC and Edinburgh University taking down websites.
OpenAI said this was “one of the most impactful security issues in recent memory”. It added an internal researcher at the company had also discovered the issue around the same time as the other firms.
The flaws had gone undetected for more than a decade. By August, after a few weeks of using advanced AI tools, they were discovered.
“Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours,” Wiz said in a blog post.
Problems were caused by a PHP flaw.
Most people may not have heard of PHP, but probably interact with it every day. PHP powers a vast number of platforms, including online shops, Wikipedia and WordPress.
When you visit a website, such as Wikipedia, PHP is the code that collects information you need and presents it in a way you can read on the web, Paul Spain, chief executive of Gorilla Cyber Security, told the BBC.
But due to a flaw that could allow attackers to take control of affected web servers without authentication and steal sensitive data, everything built on PHP was left exposed.
While AI found the issue here, it could also be used to exploit it.
The vulnerabilities were found by researchers at the security firms Calif and Wiz. The researchers used advanced AI tools that are able to analyse code and find flaws much faster than humans or older systems can.
They said, the underlying bugs weren’t new; what changed was our ability to find them.
In the UK, the National Cyber Security Centre is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
Their warning said the security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. .
,
.
