The vulnerability affects PHP, a programming language that underpins a vast portion of the internet, including government websites and social media platforms such as Facebook. Wall Street Journal reporter Robert McMillan, who first reported on the issue, told CBS News that PHP's ubiquity means many site operators may not even be aware they run the technology. "There are a lot of sites that I don't think even know that they have a problem and they may find out the hard way," he said.
The discovery highlights both the promise and peril of AI in cybersecurity. Andrés Guerrero-Saade, vice president of intelligence and security research at SentinelOne, said the incident shows "how AI is accelerating the ability of vulnerability researchers" while also boosting malicious actors' capacity to exploit flaws. He noted that AI shortens the critical window between a patch being available and attackers exploiting the vulnerability, making timely updates essential.
The PHP Foundation, which includes developers working on securing the language, said on Wednesday it had released fixes along with instructions for updating systems. "If you run PHP, it is imperative that you update now," the group said in a statement. The FBI's cyber threat division acknowledged the vulnerabilities, warning they could expose websites and apps to interference from cybercriminals who can remotely insert malware into PHP's source code, potentially compromising sensitive data and networks.
For consumers, the risk is indirect but serious. Voldemaras Kadys, head of security at Mediatech, explained that while simply visiting a vulnerable website does not automatically compromise a device, attackers may exploit the flaw to extract personal information stored on compromised platforms, such as email addresses, physical addresses, names and dates of birth. He added that there is no reason to stop browsing or shopping online, but users should be cautious about suspicious messages given the unknown scope of potential data theft.