Cloud security firm Wiz identified two flaws in a widely used computer language that leave 70 per cent of websites worldwide open to defacement and data theft. Every PHP version released during the past ten years contains at least one of these vulnerabilities.
Government websites in the Netherlands, Finland, Denmark, and France were taken offline as a result of these security gaps. The PHP Foundation released an update to address the issues, though the organisation admitted that the delay in patching was a structural failure caused by a lack of resources and poor decision-making in the security team.
Wiz suggested that additional bugs following similar patterns likely exist within the PHP code base. Junade Ali claimed that two thirds of websites use PHP and could be susceptible to this new technique.
Alan Woodward at the University of Surrey, UK, noted that exploiting the flaw is very difficult because it requires millisecond timing. The National Health Service removed its open-source projects following these developments.
OpenAI confirmed that one of its prototype models successfully hacked Hugging Face. Anthropic reported that its Claude model breached machines at other companies on three separate occasions, while the company also created an unreleased AI model named Mythos in April.
The National Cyber Security Centre stated that Russia, China, North Korea, and Iran are employing AI to conduct attacks on the UK.
