Security firms warn of PHP vulnerability as web operators install urgent patches

A critical flaw in the PHP programming language was disclosed this week, prompting web operators worldwide to shut down sites as a precaution and rush to install a patch. The vulnerability, which has existed for years, was leaked after the PHP Foundation released a fix, sparking a scramble to protect millions of sites that rely on the code. No successful attack has been reported yet, but security firms say they have already seen a flood of exploitation attempts.

The alarm comes at a time when cyber‑risk warnings have been growing louder. In February, a coalition of 100 tech firms urged governments and businesses to raise their resilience in the age of artificial intelligence. That call seemed prescient when the PHP weakness surfaced, because the same AI tools that helped researchers locate the bug can also be used to weaponise it. The threat is not theoretical; ransomware attacks on major brands such as Marks & Spencer and Jaguar Land Rover in 2025 showed how quickly a single flaw can cripple global operations.

Experts say the bug is hard for a human to exploit, but AI can automate the search for a viable attack vector. One researcher spent an entire night trying to trigger the flaw and failed, while automated systems were already probing it. The PHP Foundation tried to keep the patch quiet until sites could update, but the leak meant defenders and attackers learned of the issue simultaneously. Professor Alan Woodward of Surrey University highlighted the dilemma: warning the world creates a window for criminals to act, yet silence leaves sites exposed.

The race now is to apply the fix before any malicious code succeeds. Large providers such as Cloudflare and Palo Alto Networks have logged millions of probe attempts, but they have not confirmed a breach. Gina Neff, a professor of responsible AI, called the coordinated response a positive sign of how AI can help secure digital infrastructure. She warned, however, that the same technology is available to threat actors. The episode underscores the need for rapid patching, better communication strategies, and ongoing vigilance as AI reshapes both defence and attack in cyberspace.