AI Uncovers Critical Software Flaw in PHP
Governments and businesses take websites offline as a precaution against potential exploitation of widespread programming language vulnerability.
Sarah Connor
Artificial intelligence agents discovered a critical software flaw in the PHP programming language.
Government cybersecurity experts are working with OpenAI and international partners to address the issue. An official stated, "Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue."
No large public-facing critical services are affected by the exercise, but some limited services may temporarily go offline as security work proceeds, an official confirmed. Downing Street claims no large UK public-facing critical services had been affected.
The Office for Budget Responsibility (OBR) took down its website as a precaution. Downing Street claims this downtime specifically addresses potential PHP cybersecurity issues, though a No 10 spokeswoman clarified, "But this does not mean they were hacked, and work continues to resolve any issues."
Baroness Lloyd of Effra stated, "The information I have is that 32 Government services are unavailable and four are partially unavailable." The DVSA system experienced issues yesterday afternoon until this morning, with garages instructed to use a paper system.
The NCSC urged organisations to update to a new, fixed version of PHP or take websites offline if immediate upgrades are not possible. A No 10 spokeswoman emphasised, "Organisations of all sizes should follow NCSC guidance to protect their system."
Human researchers identified the flaw in 2024 but initially dismissed it as too complicated to exploit. Cyber security chiefs claim a researcher using AI discovered the issue.
Alan Woodward, an expert, noted the patch for the vulnerability was released yesterday afternoon. He explained, "And what happened, unfortunately, the day before the patch was out, somebody let the cat out of the bag."
Somebody let the cat out of the bag.
Woodward added, "There was an initial version of the patch that was released, and so it was very easy to compare the original with the patched version and see which bit of code you needed to go and exploit." He highlighted the scramble to implement the patch, stating, "People have been scrambling away, saying, 'Well, actually, yes, you can exploit it, and we now need to patch it'."
Sir David Omand claims Russia and China exploit the PHP bug. However, Douglas Alexander stated, "No, I've had no indication whatsoever that there's any problem in terms of a breach of Budget security."