Two critical, decade-old memory safety flaws in the widely used PHP programming language were uncovered with the help of AI, prompting urgent global cybersecurity responses to prevent potential remote code execution attacks. While patches are available and major sites have acted swiftly, ongoing vigilance is essential, especially for midsized organizations and critical infrastructure relying on outdated PHP-based systems, highlighting the persistent challenge of maintaining internet security.
A major cybersecurity scare has emerged due to two critical flaws discovered in PHP, a widely used programming language that powers much of the internet. These vulnerabilities, which had gone undetected for over a decade, allow for remote code execution, meaning attackers could potentially take control of affected computers. As a result, internet security teams worldwide have been forced to take websites offline temporarily to apply urgent patches. Governments, including Japan’s, have issued warnings urging website owners to check for PHP usage and update their systems promptly to prevent exploitation.
Tara Wheeler, an information security executive and AI researcher, explains that PHP is a long-standing, easy-to-learn language used to build many websites, which has led to numerous versions and outdated, insecure installations still in use. The flaws involve memory safety issues, where attackers can overflow requests to cause unintended behavior, enabling remote control of vulnerable systems. While the vulnerabilities are serious due to PHP’s widespread use across businesses, academia, and critical infrastructure, patches are already available, and many major sites have proactively taken measures to mitigate the risk.
Despite the severity, Wheeler notes that the immediate impact has been limited, thanks to rapid responses from security teams. However, the possibility remains that some exploitation may have gone undetected, as is often the case with such vulnerabilities. She emphasizes that memory safety bugs are a persistent problem in internet infrastructure, likening them to “the asbestos of the internet,” requiring ongoing vigilance and patching to maintain security.
Interestingly, AI played a key role in uncovering these long-hidden flaws before any large-scale attacks occurred. Wheeler clarifies that AI is not necessarily smarter than humans in finding vulnerabilities but is faster and more efficient at identifying known or basic security issues. She also addresses concerns about rogue AI agents, suggesting that fears are often exaggerated and that proper cybersecurity hygiene and safeguards can mitigate risks associated with AI tools.
Finally, Wheeler highlights that the greatest risk lies with midsized organizations and critical infrastructure that may unknowingly run outdated PHP-based websites, such as those built on WordPress, Joomla, or Drupal. She stresses the responsibility of larger companies to update to memory-safe languages and communicate security implications clearly to their clients. Governments’ top-level warnings serve as an important reminder of the ongoing need for cybersecurity vigilance, as the internet will continue to face similar challenges requiring constant attention and proactive defense measures.