Several European governments disconnect their websites due to the risk of cyberattacks

BarcelonaThousands of websites, including those of various governments in Europe and other parts of the world, were taken offline this Wednesday as a preventive measure against the risk of cyberattacks. This happened after two serious vulnerabilities were disclosed in PHP, a programming language used by a large part of the websites on the internet worldwide. This has forced the administrators of numerous websites to take urgent measures to protect their systems.

The developers of this programming language have released new urgent patches for vulnerabilities that had remained latent in their software for years, until they were discovered using artificial intelligence. The developing companies have urged all users to perform updates immediately and have warned that some hackers were already exploiting the flaws. "If you use PHP, it is essential that you update it now," wrote the PHP Foundation, the entity that oversees the development and maintenance of the software, in a statement on its blog.

Cybersecurity agencies in Europe, the United States, Australia, Japan, and the United Kingdom have urged PHP users to update their systems or disconnect their websites until the updates can be applied. Among the affected countries are the Netherlands, which has disconnected, among others, the official Parliament website and the digital identification system that allows access to public services such as tax administration and healthcare. Wikipedia also reported that it had deactivated an indeterminate number of systems until they could be updated securely.

Since the solution is already public and artificial intelligence tools can easily reverse-engineer the error, experts warn that there may be a wave of intrusions. The flaws could allow cybercriminals to remotely access the servers of the affected pages, take control of them, or steal information from their users.

PHP, a language created in the early 1990s and which originally stood forpersonal home page, is one of the most widespread programming languages on the internet, present on nearly 75% of websites worldwide. This means that any critical vulnerability could have enormous ripple effects and affect organizations and users in many countries. PHP operates in the background: when a user loads a page, the server running PHP gathers the content and sends the final page to the browser. It is free, open-source, and maintained by volunteers. It is, for example, the engine behind WordPress, the software on which a large part of websites are based.

The dangers of AI

The PHP Foundation has explained that a security researcher found the first signs of a flaw that led to one of the vulnerabilities in 2024. The problem was "theorized, but no concrete vectors were found and other specific problems with a clear impact overshadowed these concerns".

Researchers from the security company Calif, in collaboration with OpenAI, reported the first vulnerability in PHP on August 11, after having detected it using artificial intelligence, according to the company itself. Wiz, a security company owned by Google, also detected the problems independently and notified a second vulnerability on August 24, also using artificial intelligence models, reports the Reuters agency.

The vulnerabilities remained hidden in the PHP codebase for more than a decade and "it would have been extraordinarily complicated for a human hacker to take advantage of them," indicated Wiz, which adds that "with AI, this is no longer a barrier".