I once worked opposite a site where a shopping centre was being built. We were warned there might be unexploded bombs from World War Two unearthed during the construction. In the end, there were none, but procedures were put in place as a precaution and we all had to practice filing into designated safe zones inside our building.
The PHP story feels like the cyber equivalent of an unexploded bomb - I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet. There has been no painful attack like the ransomware we saw knock out M&S and JLR in 2025. But the potential threat is so serious that websites around the world have been taken down as a precaution.
Less than two months ago, 100 tech companies wrote an open letter warning the world to adopt a new level of cyber resilience in the age of AI. It turns out we didn't have to wait very long to find out what they meant. The weaknesses found in the PHP programming language, which is used by millions of websites, had been quietly resting there for years and are not easy to exploit.
One cyber security researcher told me he'd been up all night trying to do it as an experiment, but it was proving very difficult. However, things that are very difficult for humans are increasingly very little trouble for AI. The tech is getting a lot of credit here for assisting researchers in finding the bugs, and the PHP foundation, which oversees the programming language, was on the case and issued a fix.
It was supposed to be kept quiet until everyone had a chance to fix their sites - but the news was leaked. From that point the clock started ticking. As I write this, there are no reports that anyone or anything has succeeded in using the flaws to attack a site.
"There's a real dilemma," said Prof Alan Woodward from Surrey University. "How do you alert people they need to be ready, and then that a patch is urgently required, whilst not alerting attackers? "Basically you're telling everyone about the problem at the same time and hoping the defenders aren't awake enough to act as soon as the patch is out." But we do know from large web companies like Cloudflare and Palo Alto Networks that millions of attempts have been made.
Extract — continue reading at the source.
