Websites down: what is PHP and how has it raised AI hacking fears?

Artificial intelligence (AI) has found serious security weaknesses in a widely used programming language called PHP. On Thursday, many websites were taken offline as organisations around the world rushed to protect themselves from possible hackers.

As AI improves quickly, people are becoming more worried that it could increase the risk of cyberattacks. Here are some questions and answers about the situation:

What is PHP, and how widely is it used?

Created in the early 1990s, PHP is a computer language used to build and run websites. It is estimated to be used by about 70 percent of the world's websites.

Security company Wiz Research calls PHP "a backbone of the web". The company says it used AI to find security weaknesses in PHP that had remained hidden for more than a decade.

PHP originally stood for Personal Home Page. It is used by popular tools for building websites. This means the weaknesses could let hackers break into many kinds of websites, including online shops and government services.

A fix was released on Wednesday. The PHP Foundation told the technology teams of companies and organisations around the world: "If you run PHP, it is imperative that you update now."

As a result, many apps and websites have gone offline while developers work to protect their code from attacks. These include the Paris police website and a sleep tracker for Pokemon.

How did AI find the weaknesses?

In August, Wiz and other groups used advanced AI models from major US companies, including OpenAI and Google, to find weaknesses in PHP.

The findings were kept secret while a fix was being developed.

OpenAI called the weaknesses "one of the most impactful vulnerabilities in recent memory". It added that this "marks a new phase, where AI can find security bugs with internet-scale impact".

Separately from Wiz, security company Calif found the weaknesses while checking PHP's code as part of an audit funded by OpenAI.

"The trouble with tools like AI is that the moment all the information's out there, people can weaponise it very, very quickly," Steve Kerrison, a senior lecturer in cybersecurity at James Cook University's Singapore campus, told AFP.

"That's why everybody's acting with such urgency to respond to this issue."

Have websites already been hacked?

Dimitrios Salampasis of Australia's Swinburne University of Technology said: "Taking websites offline does not necessarily mean they have been hacked. It can be a responsible measure to protect systems while security updates are applied."

So far, "the evidence that security researchers are seeing is that nobody was actively performing attacks using the techniques available", Kerrison said.

Large organisations, including government agencies and news outlets, should be able to fix their websites fairly quickly. But other websites may remain at risk.

"There are sites, systems and people out there who will have no idea about this and still won't for days, weeks and months," Kerrison warned.

These could include personal blogs run by individual users. Hackers might use such sites to spread computer viruses, send spam or share harmful content.

Could there be other consequences?

A data breach could put customers at risk in the future if their personal information is used in so-called "phishing" attacks. In these attacks, someone tricks a person into sharing their password for an online service.

Online systems are often complex and connected to one another. They also frequently use tools and services provided by other companies. Because of this, some security weaknesses may remain even after the main problem has been fixed.

If those other companies use PHP, "then even though you patched yourself... you're still unsecure", said Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales in Sydney.

However, PHP is only one part of the picture. Strong cybersecurity should use several layers of protection, Kerrison said.

kaf/dan