PHP Flaws Described as 'Unexploded Bomb' as Global Patching Race Begins

Kleinman wrote that she had 'never seen such a dramatic, public and global response to a cyber event that hasn't happened yet.' The flaws are in PHP, a programming language used by millions of websites. They had rested quietly in the language for years and are not easy to exploit, according to the report.

One cybersecurity researcher told Kleinman he had been up all night trying to exploit the flaws as an experiment, but the effort was proving very difficult. The discovery of the long-hidden weaknesses was AI-assisted, the report said, and it set off a worldwide security scramble.

The news was supposed to be kept quiet until everyone had a chance to fix their sites, but it leaked. 'From that point the clock started ticking,' Kleinman wrote. As of the report, there were no reports that anyone or anything had succeeded in using the flaws to attack a site.

Prof Alan Woodward of Surrey University described the disclosure dilemma. 'How do you alert people they need to be ready, and then that a patch is urgently required, whilst not alerting attackers?' he said. 'Basically you're telling everyone about the problem at the same time and hoping the defenders aren't awake enough to act as soon as the patch is out.'

Information from large web companies including Cloudflare and Palo Alto Networks showed millions of attempts had been made, according to the report. It may not be known for a while whether any criminals succeeded, because affected companies might not yet be aware either.

Kleinman wrote that, as far as is known, 'the unexploded bomb remains intact for now,' and for some experts this is a success. Gina Neff, Professor of Responsible AI at Queen Mary University, told BBC Radio 4's Today program: 'We've seen how a team of people supported by the large AI company have used AI to find the problem, work for months together to solve it and get everybody ready to be safe and secure.' She added: 'We have enormous capability to handle these risks.'