BBC, Wikipedia among Major Sites hit by Global Cybersecurity Scare over Critical PHP Flaws

A major cybersecurity scare has sent shockwaves across the internet, forcing government agencies, media organisations and major online platforms to temporarily shut down services after artificial intelligence helped uncover two potentially devastating security vulnerabilities in PHP, the programming language used by millions of websites worldwide.

The discovery triggered urgent warnings from cybersecurity agencies across several countries, with organisations advised to install emergency security patches or consider taking vulnerable websites offline to prevent possible cyberattacks.

The vulnerabilities, reportedly hidden in PHP for more than a decade, were identified within weeks using advanced artificial intelligence tools. Security fixes were released on Wednesday afternoon, but concerns intensified after details of the flaws leaked on social media a day earlier.

The cybersecurity alert has prompted precautionary shutdowns across multiple countries, including Finland, the Netherlands and the United Kingdom. Finland temporarily suspended public-facing government web services, while the Netherlands’ national cybersecurity agency also took its website offline.

In Britain, Edinburgh City Council’s website was affected, alongside several BBC programme websites, including those associated with Doctor Who and The Traitors. Wikipedia users also encountered access problems on Wednesday after the Wikimedia Foundation confirmed that it was taking protective measures against the newly discovered vulnerabilities.

The foundation said several additional systems had been temporarily disabled until they could be safely updated. However, not every reported website disruption has been conclusively linked to the PHP security flaws. Some organisations have yet to establish or publicly confirm the precise causes of their outages.

The online art platform DeviantArt also displayed a temporary maintenance notice without explaining whether the shutdown was related to the wider cybersecurity alert.

US National Security Agency (NSA) issued an urgent advisory recommending that organisations unable to deploy security updates immediately consider temporarily disabling potentially vulnerable systems. According to the agency, the flaws could allow attackers to gain direct access to server file systems or databases, potentially exposing sensitive information and critical infrastructure.

The White House also acknowledged the seriousness of the situation, saying federal agencies were collaborating with leading artificial intelligence companies to accelerate efforts to address the vulnerabilities.

One of the key aspects of cybersecurity scare is how the vulnerabilities were discovered. Researchers from cybersecurity companies Calif and Wiz reportedly identified the flaws through OpenAI’s “Patch the Planet” initiative, which provides experts with advanced AI tools to identify and resolve weaknesses in widely used programming languages.

According to reports, the vulnerabilities had escaped detection for more than ten years before AI-assisted researchers uncovered them within weeks. OpenAI described the discovery in a blog post as one of the most significant cybersecurity issues identified in recent years. Wiz characterised the flaws as among the most serious vulnerabilities discovered with the assistance of artificial intelligence.

The potential scale of the threat has raised particular concern because PHP remains one of the world’s most widely used server-side programming languages. Wiz estimated that roughly 70 percent of the internet could fall within the broader potential exposure associated with PHP’s widespread adoption.

The timing of the disclosure has added another layer of urgency. PHP Foundation had reportedly intended to publish full technical details and comprehensive security fixes later this month, allowing organisations additional time to prepare.

Those plans changed when information about the vulnerabilities surfaced on social media on Tuesday, raising fears that attackers could exploit the weaknesses before protective updates were widely deployed.

Emergency security fixes were subsequently released on Wednesday afternoon, while cybersecurity authorities urged organisations to act without delay.

The incident shows growing reality of the digital age, as AI is becoming strong weapon for identifying hidden software vulnerabilities, but the same technological advances could also help malicious actors discover and exploit security weaknesses.

Mossad, Malware, and Media: How a Pakistani TV Channel Got Hacked for Psychological Warfare