AI Learned to Hack, and Found Bugs Hidden for Years
A flaw in the code behind two thirds of websites forced governments and Wikipedia to go dark while they patched.
Global News Podcast · US and European websites go offline over security concernsParts of the internet went dark while organizations rushed to install emergency patches for flaws hidden in code that runs much of the web.
The flaws were found by Wiz, a cybersecurity company, in PHP, a programming language that quietly powers roughly two out of every three websites and apps. You never see PHP, but when you load a page, fill a form, or log in, it is often the backstage machinery that builds the page and talks to the database. Wiz reportedly described the problems as the most severe vulnerabilities discovered by the technology so far.
Here is how one hidden bug can force the world offline. First, an AI system scans through old, widely reused code and spots a weakness that had been sitting there for years, and in some cases for decades. Then the finder alerts the public, and governments from France to Finland issue warnings that include a patch, which is a small fix that closes the hole. Organizations are told to install that patch immediately, because until they do, an attacker who knows the flaw can break into servers, steal data, or take down sites.
That urgency explains why some pages disappeared at once. Groups that needed time to apply the fix were advised to take their own sites offline first, and some did, from government services to Wikipedia pages to program pages at a major broadcaster.
The same skill works both ways, said Lily Jamali, a technology reporter who covered the alerts. Good actors can use AI to hunt down and fix long buried flaws. Bad actors can use the same ability to find those flaws and exploit them.
One possible result is that governments play a larger guiding role as AI systems get more sophisticated. Britain has already urged every organization to figure out how exposed it is and to take steps to protect its systems.
Questions people ask
What exactly is a software patch?
A patch is a small update to software that fixes a specific problem, much like a tailor stitching a tear in a jacket. For a security flaw, it rewrites the vulnerable part of the code so attackers can no longer slip through it. Until you install it, the hole stays open.
Could a flaw like this put my personal data at risk?
Yes, if attackers exploit an unpatched flaw on a site that stores your information. They can potentially copy login details, email addresses, or payment records, or knock the site offline. That is why organizations sometimes take pages down entirely until the fix is in place.
How can I tell if a website I use runs on PHP?
It is hard for an ordinary visitor to tell, because sites rarely advertise what language runs underneath them. The warnings in this case went to organizations that run websites, telling them to check their exposure and patch. As a visitor, you mainly see the result when a site temporarily goes offline to fix itself.