Connect with us

Tech

AI Discovery of Critical PHP Flaws Triggers Global Website Shutdowns

Published

on

Artificial intelligence helped uncover two critical security vulnerabilities in PHP, a programming language used by about 70 per cent of websites worldwide, prompting government agencies, businesses and online platforms to take services offline while installing emergency fixes.

The flaws had remained undetected for more than a decade and could allow attackers to execute malicious code on vulnerable servers without logging in. The discovery triggered precautionary shutdowns across Europe, affecting services ranging from the Netherlands’ digital identity system and parliament website to government portals, hospitals and commercial platforms.

The Netherlands temporarily took its DigiD digital identity service, the Overheid.nl government portal and the lower house of parliament’s website offline. Finland’s state IT provider, Valtori, suspended government web services, while France and Germany also restricted access to several public websites.

CERT-EU, the cybersecurity service for European Union institutions, advised organisations unable to apply the fixes immediately to take affected websites offline. European institutions and national cyber response teams jointly urged operators to prioritise internet-facing systems.

PHP, originally named Personal Home Page, handles behind-the-scenes website functions such as processing payments, checking user logins and delivering content. It underpins widely used platforms including WordPress, Drupal and Joomla, making vulnerabilities in the language a potential threat to millions of online services.

The PHP Foundation released security updates on Wednesday and urged administrators to upgrade immediately. Patched versions include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions no longer receiving official updates should be considered vulnerable unless suppliers have applied the fixes separately.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, received severity ratings of 9.2 out of 10. They affect areas involving memory management and error handling, potentially enabling remote code execution under specific conditions.

See also  Meta Apps Collect More User Data Than Other Big Tech, Study Finds

The PHP Foundation said developers had identified early signs of the problem during an external audit in 2024, but efforts to develop a practical exploit and determine an appropriate fix stalled for months. It described the delay as “a structural failure”.

Artificial intelligence subsequently helped researchers establish working attack methods. Security firm Calif identified a functional remote attack in August during an OpenAI-funded audit using OpenAI’s GPT-5.6 Sol model. OpenAI independently identified the same issue, while Wiz later found additional attack methods using its Wiz Atlas tool, Google’s Gemini 4 Argon and GPT-5.6 Sol.

Wiz researchers said one researcher had completed in a week work that might previously have required a specialist team months to accomplish. OpenAI described the findings as “one of the most impactful vulnerabilities in recent memory”.

The vulnerabilities were initially disclosed privately while developers prepared a patch. However, the identifiers leaked online on Tuesday, prompting PHP to bring forward the release. Technical details and proof-of-concept material subsequently circulated, increasing fears that attackers could quickly develop working exploits.

Security experts stressed that taking websites offline did not necessarily mean they had been compromised. The PHP Foundation said its security team found no functional exploit in the proof-of-concept material circulating when the patch was released.

However, Cloudflare reported observing attack traffic targeting its customers on Wednesday, while CERT-EU warned that public disclosure increased the likelihood of active probing.

Experts warned that smaller businesses and independently operated websites could remain exposed for weeks or months if their administrators failed to apply updates. Even organisations that patch their own systems may face risks from third-party services that remain vulnerable.

See also  Mobile World Congress Opens in Barcelona With Focus on AI and 5G Concerns

The incident has also renewed calls for stronger investment in software security. The PHP Foundation relies on a relatively small group of funded developers and volunteers to maintain technology used by governments, banks and online retailers worldwide. Researchers say AI can accelerate vulnerability discovery, but experienced engineers remain essential to developing safe fixes and protecting interconnected systems.

Tech

Microsoft Outage Renews Calls for Europe to Reduce Reliance on US Cloud Providers

Published

on

A global Microsoft outage that disrupted Outlook and Teams services across 74 countries has renewed calls for Europe to reduce its dependence on American technology companies and strengthen its own cloud computing industry.

The disruption, which began on Thursday afternoon European time, left users unable to access emails and online meetings. Some doctors’ surgeries in the UK asked patients to telephone them with urgent enquiries. Microsoft said it had found no evidence of a cyberattack, but had not identified the root cause. Services were gradually restored on Friday.

The incident has added urgency to concerns about Europe’s reliance on a small number of US providers. Tommaso Valletti, professor of economics at Imperial College Business School and a former chief competition economist at the European Commission, said the outage highlighted the risks of depending heavily on a handful of large technology companies.

Amazon, Microsoft and Google control around 70% of the European cloud market, according to Synergy Research Group. European providers account for approximately 15%, down from 29% in 2017. Germany’s SAP and Deutsche Telekom are among the largest local players, but each holds only about 2% of the market.

The figures reflect a wider dependence on foreign technology, with around 80% of Europe’s digital infrastructure and technology coming from outside the European Union. A recent Eurobarometer survey found strong public support for digital infrastructure controlled within Europe, particularly in Sweden, Finland and Denmark.

Brussels pushes for European alternatives

The debate gained momentum on Wednesday when members of the European Parliament presented a draft report on the European Commission’s proposed Cloud and AI Development Act. The report calls for public authorities to purchase more cloud services from European companies.

See also  Taiwan’s AI Stock Boom Fuels Borrowing Frenzy as Investors Chase Big Gains

Dutch Green MEP Reinier van Lanschot warned that dependence on foreign technology could leave critical systems vulnerable to decisions made outside Europe.

Concerns about access to technology increased in June when US company Anthropic suspended access to its Claude Fable 5 and Mythos 5 AI models to comply with American export controls. Access was restored on 1 July.

The European Commission also plans to triple the bloc’s data centre capacity over the next five to seven years. Bidding for up to seven EU-backed artificial intelligence gigafactories closed on Thursday.

European companies seek a larger role

Europe has several companies operating in different parts of the technology industry, although none currently matches the scale of the American giants.

French AI developer Mistral AI was valued at €21 billion following a €3 billion funding round led by Samsung in September. In cloud computing, Germany’s STACKIT is developing an €11 billion AI data centre in Brandenburg. It has joined OVHcloud, Scaleway and Mistral in securing places on an EU sovereign cloud contract worth up to €180 million.

Germany’s Infineon is also seen as a potential beneficiary of growing demand for AI infrastructure through its production of power-management chips.

However, persuading businesses to switch providers remains difficult. A Bitkom survey found that 85% of German companies considered the country too dependent on US cloud services, yet 71% continued to use them. Research by IDC found that only 4% of European organisations planned to rely exclusively on local providers.

The European Parliament’s committees are due to discuss the draft legislation on 1 December. A committee vote is provisionally scheduled for March 2027, followed by a parliamentary vote in April. Microsoft has promised to publish a report explaining the outage once all services have been restored.

Continue Reading

Tech

Web Summit Cancels Second Day in Lisbon as Storm Charles Disrupts Portugal

Published

on

Web Summit technology conference in Lisbon has cancelled its second day after the Portuguese government warned of serious risks from Storm Charles, which is expected to bring strong winds, coastal flooding and widespread disruption to public transport.

OrganiserThe s confirmed on Tuesday that Wednesday’s programme would not go ahead, following consultations with the government, the National Emergency and Civil Protection Authority (ANEPC) and the Public Security Police (PSP).

In an email to attendees, Web Summit said the government had formally advised against holding the event because of the potential dangers posed by the storm.

The warning cited the risk of tidal flooding, severe disruption to public transport and high winds that could affect external structures at the conference venue.

“Web Summit will of course respect the Government’s direction, and accordingly, Day 2 (Wednesday, November 11th) will not take place,” the organisers said, adding that the safety of attendees, staff and contractors remained their priority.

The conference is scheduled to resume on Thursday, subject to conditions and further official guidance.

The decision came after Portugal declared a state of emergency in response to the approaching storm. The government announced that schools and non-essential public services would close across the country on Wednesday as precautionary measures.

Minister of Internal Administration officials outlined the restrictions during a briefing at ANEPC headquarters in Carnaxide. Authorities also prohibited access to coastal areas, riverbanks and other locations considered vulnerable to flooding.

The Ministry of Internal Affairs said the restrictions would apply particularly to areas with a history of flooding and other weather-related hazards.

See also  Lancet Study Warns AI Misuse and Nuclear War Could Threaten Humanity by 2100

Lisbon Mayor Carlos Moedas had earlier suggested that the technology conference should be cancelled, although he left the final decision to the central government and the event organisers.

Web Summit is being held at the Feira Internacional de Lisboa (FIL) exhibition centre in Parque das Nações, close to the city’s waterfront. Its location has raised concerns because of the potential impact of coastal flooding and strong winds on surrounding infrastructure.

The event was expected to attract close to 70,000 participants, including around 900 speakers and more than 2,000 start-ups. The gathering brings together technology companies, investors, entrepreneurs and policymakers from across the world.

The cancellation of Wednesday’s programme represents a disruption to one of Europe’s major technology gatherings, although organisers have indicated that activities are expected to continue on Thursday.

Authorities have urged residents and visitors to follow official safety instructions, avoid restricted areas and limit unnecessary travel while Storm Charles affects the country.

Continue Reading

Tech

Cyberattacks on Critical Infrastructure Expose Human Errors as a Major Security Risk

Published

on

Cyberattacks targeting essential services, including supermarket refrigeration systems, blood donation facilities and government networks, are increasing, with cybersecurity experts warning that human error remains one of the main ways criminals gain access to vulnerable systems.

Marco Di Filippo, a cybersecurity specialist at German firm Whitelisthackers, said an unusual concentration of major incidents had occurred within a short period.

“In the past two weeks we have seen an exceptional concentration of spectacular cases of a kind we would previously not have experienced even over the course of an entire year,” he told Euronews.

Recent incidents have included the theft of hundreds of thousands of emails belonging to members of Germany’s far-right Alternative for Germany party, vulnerabilities affecting financial services company Revolut and the PHP programming language, as well as attacks disrupting refrigeration systems.

Germany’s Federal Criminal Police Office recorded economic damage of €202.4 billion from cybercrime in 2025, highlighting the growing financial risks to businesses and public institutions.

One of the most serious recent incidents involved a cyberattack on Berlin’s state network in August 2026. The ransomware group Rhysida demanded 30 bitcoin, worth approximately €2 million, but the Berlin Senate refused to pay. The attackers subsequently published 1.4 million confidential files on the dark web.

Di Filippo said the breach began when an employee was tricked into visiting a malicious website using a technique known as ClickFix. The victim was instructed to confirm they were human by copying and executing a computer command.

By following the instructions, the employee unknowingly gave attackers access to the system. Di Filippo said the incident exposed two weaknesses: insufficient awareness among staff and excessive access privileges that allowed an ordinary user to execute the harmful command.

See also  France to Replace Microsoft Teams and Zoom with Domestic Platform by 2027

He estimates that people are involved in allowing security weaknesses to be exploited in between 80% and 95% of cyberattacks.

The expert warned that increasing connectivity was creating new risks. Internet-connected appliances, including supermarket refrigerators, can be controlled remotely, but inadequate security measures may allow criminals to interfere with their operation. Recent attacks on refrigeration systems have also affected blood donation services, with disrupted cooling reportedly rendering some donations unusable.

Cybercriminals can also gain access to private messages through techniques such as WhatsApp ghost pairing. Germany’s Federal Office for Information Security has advised users to examine unexpected messages carefully and activate two-factor authentication.

Di Filippo believes public education should become a central part of cybersecurity policy. He pointed to awareness campaigns in India, where public transport advertisements provide information about cybercrime and reporting hotlines.

His company takes a different approach by testing systems using methods similar to those employed by criminal hackers, but with the permission of clients. Its specialists identify weaknesses and provide detailed reports explaining how they can be fixed.

Whitelisthackers works with around 250 clients annually. Once vulnerabilities are identified, manufacturers and organisations are notified so they can address the problems before criminals exploit them.

Di Filippo said technology alone could not prevent attacks. Improving digital awareness among employees and the public, alongside stronger technical safeguards, was essential to protecting critical infrastructure.

Continue Reading

Trending