Websites taken down worldwide as AI reveals critical cyber-security threat | BBC News

Cyberattacks exploiting PHP vulnerabilities

Governments, companies and public bodies took websites offline amid fears of cyberattacks exploiting two critical flaws in PHP, a programming language used by as much as 70% of the world’s websites. A fix has been issued, but organizations that have not yet applied it may remain at risk.

Cybersecurity researchers used advanced AI models to find the flaws. They said the AI identified a complex sequence of steps that could allow attackers to compromise websites—work they described as beyond what human researchers could practically achieve.

The discovery initially appeared to be a potential example of AI helping defenders. But the risk escalated after attackers learned of the vulnerabilities and began using AI to work out how to exploit them.

BBC cyber correspondent Joe Tidy reported that the websites taken offline included Edinburgh Council’s and the BBC’s Doctor Who site, as well as sites belonging to organizations in Japan, Belgium and the Netherlands. Some cybersecurity authorities also took their own websites offline while warning others. Tidy said more organizations could act as they assess whether they are vulnerable.

Presenters and contributors

• BBC presenter, not named in the subtitles
• Joe Tidy, BBC cyber correspondent