PHP developers released a fix on Oct. 21 for two serious security flaws, while government and other websites went offline as operators worked to protect their systems, AFP reports.
OpenAI says security firm Calif identified a critical flaw using its GPT-5.6 Sol model, and Wiz independently discovered and reported both vulnerabilities. According to AFP, Calif found the flaws in August during an OpenAI-funded audit of PHP code; Wiz found them weeks later.
What the flaws could expose
The two flaws concern PHP's handling of memory errors, New Scientist reports. Under certain circumstances, data left after an error could expose private information or allow an attacker to run malicious code. The outlet quotes University of Surrey researcher Alan Woodward saying exploitation requires "millisecond timing" and that AI could help work through possible timings. That is an assessment of what AI could do, not a report that attackers used it against these flaws.
PHP helps run about 70 percent of the world's websites, according to Wiz Research as cited by AFP. That is a usage figure, not a count of vulnerable websites: AFP says only sites running PHP on their own servers are exposed.
Why sites went offline
Neowin reports, based on an account from PHP's maintainers, that the security release was moved from Oct. 22 to Oct. 21 after vulnerability identifiers began circulating online. Those initial identifiers lacked technical details; Neowin separately describes an accidentally published proof-of-concept video.
AFP reports that government agency sites in Australia, Finland and the Netherlands were among those that went dark. Its separate report names the Paris police website and a Pokémon sleep tracker among services taken offline while developers worked on protections.
"Taking websites offline does not necessarily mean they have been hacked. It can be a responsible measure to protect systems while security updates are applied," Swinburne University of Technology's Dimitrios Salampasis told AFP. In that report, cybersecurity lecturer Steve Kerrison said researchers then saw no evidence of active attacks using the available techniques. OpenAI urges organizations using PHP to apply the fixes.
Comments