⁠Scale of cyber-security flaw 'unprecedented' but no sign of breaches, says expert

⁠Scale of cyber-security flaw 'unprecedented' but no sign of breaches, says expert

A critical vulnerability in PHP, the decades-old programming language that quietly powers a huge share of the web, has forced governments and major companies worldwide to take websites and online services offline as a precaution. Security firm Wiz estimates the flaw affects roughly 70 percent of the internet, potentially exposing tens of millions of websites to attackers who could steal personal data, plant backdoors, or move deeper into networks. The flaw was uncovered with help from artificial intelligence through OpenAI’s Patch the Planet initiative, and researchers describe it as the most serious vulnerability they have ever found. Scottish councils, NHS boards, the UK Office for Budget Responsibility, and government sites in Finland, the Netherlands, and France were among those temporarily disrupted, with some online account and payment systems still affected. The US National Security Agency has warned organisations to take affected systems offline until a fix is applied, and the UK National Cyber Security Centre issued similar guidance. So far, researchers say there is no evidence of widespread exploitation, but companies including Amazon have detected probing attempts. A patch has been rushed out, and the immediate focus is on getting millions of websites updated before attackers can turn the flaw into real breaches.