Government Websites Go Dark After AI-Discovered Flaw Sparks Security Scramble
Government websites across Europe went dark on Wednesday as operators scrambled to patch two critical vulnerabilities in PHP, a widely used programming language that runs many websites. The developers of PHP announced that they would release patches for the flaws, which were discovered by researchers using AI models. EU cybersecurity officials warned organizations that were unable to apply the fixes to take affected websites offline to prevent potential attacks.
The two vulnerabilities, rated 9.2 out of 10 on the CVSS v4.0 severity scale, could allow an attacker to run commands on a vulnerable server with no password or account, potentially leading to stolen data, defaced pages, or full-system compromise. The flaws had been present for decades, but were only recently discovered using AI models.
The States of Guernsey, a government in the Channel Islands, took several of its websites temporarily offline as a precaution, including its government site, revenue service portal, and post-16 education site. The UK's Cyber Security Centre said the security issue had been fixed, but warned that the flaws could have allowed an attack to trigger "memory corruption".
The discovery of the flaws highlights the importance of keeping software up to date, especially for small websites that may not have dedicated security staff. The usual automatic updates will not apply this fix, and experts are warning that affected sites should be taken offline rather than left exposed.
