As artificial intelligence accelerates the speed of digital threats, governments and tech giants are scrambling to protect online infrastructure following the discovery of critical vulnerabilities in the PHP programming language.
According to BBC News, the UK government announced it is working to identify any potential exposure in its online services. The flaws affect PHP, a foundational programming language that underpins a significant portion of the world's websites, including popular platforms like Wikipedia and WordPress.
BBC News reported that Amazon was targeted in multiple cyber-attack attempts. Amazon security chief CJ Moses stated that the company identified a "PHP2Shell exploitation attempt" on 17 October targeting a decoy honeypot system using an anonymous internet address. Subsequent attacks occurred on 21 October, featuring varying payloads and anonymisation infrastructure, which suggested multiple threat actors were involved.
According to BBC News, the vulnerabilities were first discovered by artificial intelligence. Although the PHP Foundation intended to release its discovery and a complete patch later in the month, details of the flaw leaked on social media. CJ Moses told BBC News that the use of AI means "more actors can act within hours or even minutes once technical details of a vulnerability are disclosed."
Background
According to BBC News, PHP powers a vast array of online platforms, shops, blogs, and content management systems by collecting information and presenting it in a readable format on the web. International cyber-security agencies, including the UK's National Cyber Security Centre (NCSC) alongside counterparts in the EU and Australia, urged organisations using PHP to apply fixes immediately. The NCSC advised in a statement reported by BBC News that where immediate remediation is not feasible, organizations should consider taking systems offline until fully mitigated. Amazon noted that the initial attacks against its systems occurred after the leak but before an embargo on the warning was lifted.
Why it matters
According to BBC News reports on statements from international officials like Australian Council on AI Strategy CEO Anna-Maria Arabia, this incident demonstrates how rapidly AI is altering the cybersecurity landscape, reducing the timeline for threat exposure from months to mere hours. For digital infrastructure globally, including public and private entities relying on web platforms, these developments underscore the critical need for rapid system updates and stringent security protocols.