A critical weakness in the internet's foundations has gone unnoticed for decades.
asserted
weakness → go → decades
But with the use of AI, it has finally been brought to light - triggering a global cybersecurity alert.
Researchers this week revealed fatal vulnerabilities in the PHP programming language - a critical open-source system built into millions of websites, from Wikipedia to government agencies.
asserted
Researchers → bring → agencies
Wiz, one of the companies that discovered the flaw, estimates '70 per cent of the internet' is affected as a result.
asserted
cent → discover → result
It has left security agencies scrambling to contain the damage since PHP released an update to patch the vulnerability on Wednesday.
asserted
PHP → leave → Wednesday
Now cybersecurity experts are warning of a wave of hacking attempts in the coming weeks as more details about the vulnerability are made public - putting your private data at risk.
Thai Duong, chief of Calif, one of the companies that found the vulnerability, told the Daily Mail: 'The reality is that there's very little the average internet user can do.
'
asserted
user → warn → Mail
Should they be concerned?
asserted
they → concern → ?
The responsibility lies with website operators, hosting providers and the broader security community.
asserted
responsibility → lie → operators
'
Here, we explain what the vulnerability is and how it could affect you.
uncertain
it → explain → you
Cybersecurity researchers using AI tools sparked a worldwide website emergency this week by revealing fatal vulnerabilities in the PHP programming language.
asserted
researchers → use → language
Pictured: Researchers using the PHP website to hack a dummy website
What is PHP?
asserted
PHP → picture → website
PHP, which stands for Hypertext Preprocessor, is a core piece of internet technology that has been used around the world since the early 2000s.
asserted
that → stand → 2000s
It was one of the very first pieces of 'server-side' web code, and has since become embedded in a vast swath of the modern internet.
asserted
It → become → internet
Whenever you visit a website, PHP is the piece of software that gathers the information you need and presents it in a way you can actually read online.
asserted
you → visit → way
Mr Duong says: 'PHP was one of the first successful dynamic languages designed for the web.
'
asserted
PHP → say → web
As an early mover, it just happens that a lot of popular software in the internet ecosystem was written in PHP.
asserted
lot → happen → PHP
Some of the biggest internet websites are written in PHP.
asserted
Some → write → PHP
'
Since it is free and open–source, meaning it is not operated by a private company or provided by a single supplier, it's particularly popular with governments and universities.
asserted
it → mean → governments
Experts compare finding a flaw in PHP to discovering that a certain type of brick has a safety recall.
asserted
type → compare → recall
As such, a lot of infrastructure will be affected and it's up to the owners themselves to find out where the weakness lies.
asserted
weakness → affect → owners
Websites have been cautioned to update to the latest version of PHP or go offline to avoid hackers.
asserted
Websites → caution → hackers
Wikipedia temporarily took several systems offline on Wednesday as a result
The vulnerability in PHP is absolutely fatal for any unpatched website, since it allows hackers to remotely execute code inside PHP itself.
asserted
hackers → take → PHP
In simple terms, that means hackers can essentially seize control of any website without needing to guess or steal the passwords.
asserted
hackers → mean → passwords
Mr Duong says: 'Once compromised, attackers could steal sensitive data, modify website content, or disrupt operations.
'
uncertain
attackers → say → operations
They could also use the compromised websites as a foothold to penetrate deeper into an organization's internal network.
uncertain
They → use → network
Likewise, experts warn that criminals can spy on and steal data from affected servers, impersonate and control legitimate websites, infect visitors with malware, edit content on websites, shut down entire sites or lock the owners out and steal huge amounts of private data.
asserted
criminals → warn → data
Shockingly, these weaknesses have been hidden inside the architecture of the internet for years.
asserted
weaknesses → hide → years
Professor Richard Buckland, of the University of New South Wales, says: 'The PHP developers have known about this vulnerability for a long time.
'
asserted
developers → say → time
Two years ago they started to worry about it seriously.
asserted
they → start → it
Apparently, they initially didn't think it was urgent as they couldn't see how an attacker could make use of the weakness.
uncertain
attacker → think → weakness
However, the current crisis has come to a head thanks to the work of cybersecurity researchers employing AI tools.
asserted
crisis → come → tools
Wiz and Calif worked with ChatGPT maker OpenAI as part of the 'Patch the Planet' project, which is hunting for these exact types of core weaknesses.
asserted
which → work → weaknesses
OpenAI CEO Sam Altman, whose firm discovered the significant flaws with a tool it created
OpenAI says Calif used its cutting-edge AI model, GPT-5.6 Sol, to find two fatal weaknesses in PHP, with Wiz independently discovering and verifying the same bugs.
asserted
Wiz → discover → bugs
In a blog post, OpenAI said it considers this to be 'one of the most impactful security issues in recent memory'.
asserted
this → say → memory
Wiz added: 'With 70 per cent of the Internet affected, the impact of PHP2Shell cannot be overstated.
'
asserted
impact → add → PHP2Shell
It marks an AI inflexion point.
asserted
It → mark → point
The vulnerable code had been there for more than a decade – what AI changed was the ability to understand the weaknesses and turn them into a working exploit.
asserted
changed → change → exploit
What happened after the flaws were revealed?
asserted
flaws → happen → ?
On Wednesday, developers behind the PHP platform released a new version of the software that includes a fix for the two vulnerabilities.
asserted
that → release → vulnerabilities
The responsibility will now fall on individual companies and website operators to ensure their sites are updated to the latest version of PHP.
asserted
sites → fall → PHP
National bodies and cybersecurity agencies have been urging websites to be sure they are protected or go offline.
asserted
they → urge → websites
…and 40 more, not listed.
The Aporia
