Global race to update computers as AI discovers most disruptive hack yet
More than two thirds of the world's websites are vulnerable to a hack that was first theorised in 2024, which AI has now made very real
A critical flaw has been discovered in PHP, a computer language used widely in websites, posing a significant risk of data theft and defacement. This vulnerability, found by cloud security firm Wiz, affects 70% of websites globally. Government sites in France, Denmark, Finland, and the Netherlands were taken offline as a precautionary measure.
PHP, commonly used in interactive websites like WordPress, Facebook, and Wikipedia, is executed on a server. The issue involves two flaws related to how PHP handles memory errors, potentially allowing malicious actors to access private information or run malicious code. Despite the vulnerability surfacing in 2024, the PHP Foundation, which oversees development, did not act promptly due to the difficulty in exploiting the flaw at the time and disagreements over the most suitable fix.
The delay has been attributed to a structural failure within the security team, combining poor decision-making and limited resources. However, AI has now accelerated the process of exploiting the flaw, making it possible with millisecond timing and the ability of AI to run continuously without breaks. Over two-thirds of websites may be vulnerable to this latest technique, but the PHP Foundation has already released an update to address the issue.
Written by urgent.news from New Scientist's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
