Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb
Cybersecurity experts have identified significant vulnerabilities in the PHP programming language that could potentially be exploited by AI-driven attacks. While no active exploits have been reported, the discovery has prompted a global precautionary response to secure websites.
Why it matters
PHP powers a vast portion of the global internet, making any unpatched vulnerability a critical risk to digital infrastructure and data security.
Image source, Getty Images Image caption, Cyber-security flaws were recently identified in the popular PHP programming language, which is used on a vast number of websites across the world
Technology and AI editor Published 13 minutes ago I once worked opposite a site where a shopping centre was being built.
We were warned there might be unexploded bombs from World War Two unearthed during the construction.
In the end, there were none, but procedures were put in place as a precaution and we all had to practice filing into designated safe zones inside our building.
The PHP story feels like the cyber equivalent of an unexploded bomb - I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet.
There has been no painful attack like the ransomware we saw knock out M&S and JLR in 2025.
Headlinne story · 7 newsrooms
Global Websites Go Dark After AI Uncovers Critical Programming Language Flaws
What every outlet reported, where they differ, and how each framed it →
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in