Websites worldwide scramble to patch critical PHP code flaw, dubbed 'cyber equivalent of unexploded bomb'

Global websites experienced widespread disruptions and temporary shutdowns this week following the discovery of critical cybersecurity flaws in PHP, a widely used programming language underpinning roughly 70% of the internet. The vulnerabilities, collectively dubbed PHP2Shell, were uncovered with the assistance of advanced artificial intelligence programs by cybersecurity firms including OpenAI, Google-owned Wiz, and Calif. These flaws, which had reportedly existed undetected for over a decade, could allow attackers to remotely execute code and access sensitive data.

The disclosure prompted an urgent global response, with the PHP Foundation rapidly releasing a patch to address the issues. Governments and organizations worldwide, including various European public services, were compelled to take their websites offline to implement the necessary updates or protect against potential exploitation.

Cybersecurity experts have drawn comparisons to the 2014 Heartbleed bug, highlighting the severity of the situation and the critical role AI played in both the discovery and the heightened urgency to secure systems. The incident underscores growing concerns about the dual potential of AI in cybersecurity, capable of both identifying deeply hidden vulnerabilities and potentially accelerating future attacks.