A vulnerability in PHP, a programming language widely used to build websites, has triggered a race between attackers exploiting the flaw and website operators attempting to secure their systems. Thomas Caspers, vice-president of Germany’s Federal Office for Information Security (BSI), has warned that websites running PHP without the relevant security updates will eventually be compromised. Artificial intelligence (AI) is enabling attackers to identify vulnerable targets and launch attacks on a scale that would be difficult to achieve manually, while millions of known vulnerabilities remain unpatched worldwide.
In an interview with the German weekly newspaper Die Zeit, Caspers said attackers were already making millions of attempts to exploit the PHP vulnerability. Using databases, they can identify affected websites and target them directly. Although AI has substantially increased their potential reach, the BSI has not identified prominent cases demonstrating widespread successful exploitation. Caspers cautioned, however, that the absence of publicly known major attacks did not establish that no intrusions had occurred.
Attackers could, for example, gain access to critical systems and extract information without immediately alerting their operators. The risk is particularly serious where organisations lack security software capable of detecting intrusions or have not checked their systems for unauthorised changes. Caspers said organisations using up-to-date security software could be cautiously optimistic that an attack would be detected, noting that all major security software providers had responded to the vulnerability by incorporating detection mechanisms.
The earliest indications of successful exploitation had appeared on smaller, privately operated websites, where users were encountering unexpected changes such as strange advertisements. But Caspers warned that the distinction between minor incidents and more serious attacks could narrow quickly if vulnerable systems remained exposed. “All web services based on PHP that have not yet installed security updates will be hacked sooner or later,” he told Die Zeit. “The decisive factor is how quickly the security updates are installed. Whether you are compromised or not is a matter of days.”
The BSI was forced to accelerate its response after information about the vulnerability appeared online two days before the planned release of the security update. Companies that discovered the flaws had worked with the PHP Foundation through a coordinated disclosure process to develop patches. The update had originally been scheduled for 22 October, but the online leak on 20 October disrupted those preparations. The agency issued a warning on Wednesday urging operators to install the update immediately or take their websites offline until they had done so.
Caspers said the warning had prompted a faster response than the agency had sometimes experienced with previous vulnerabilities. Some websites had been taken offline, while many operators had begun installing the updates promptly. He suggested that a major cyber incident involving Berlin’s administration in August might have contributed to the increased urgency.
During that incident, hackers reportedly extorted the Berlin administration and obtained 5.8 terabytes of data. After the authorities refused to pay, the criminals published tens of thousands of emails, telephone numbers and passwords online. Caspers described the incident as a clear warning that had made website operators more conscious of their exposure. The episode also illustrates the potential consequences of successful intrusions extending beyond individual websites to the information held by public institutions.
The implications for critical infrastructure, including electricity networks and hospitals, are a particular concern for the BSI. Caspers said the principal risk was that individual organisations operating within critical infrastructure might fail to install the security update and subsequently be compromised. Attackers seeking ransom payments did not need to disable thousands of systems to achieve their objectives. “They only need two or three really large targets to be successful,” he said. “We, on the other hand, have to protect everyone.”
The scale of the problem is compounded by the growing accessibility of cyberattacks through AI. Caspers said authorities worldwide were observing tens of millions of PHP vulnerabilities that remained unpatched despite the availability of an update. Feeding information about these specific weaknesses into an AI system and instructing an autonomous agent to attack vulnerable websites could create a new form of threat. The BSI had not yet observed that particular scenario, he said, but the technical possibilities already existed.
The PHP vulnerability emerged in the same week as another security flaw affecting Node.js, software used by more than 5 per cent of websites. For Caspers, the danger is no longer hypothetical. “We are not heading towards this situation; we are already in it,” he told Die Zeit.
Defence must therefore develop at a comparable speed to the technology used by attackers. Caspers argued that human responses alone were no longer fast enough to manage the scale of the threat, making AI-assisted security essential. Major cybersecurity companies were already using AI to identify vulnerabilities and help repair them. However, he acknowledged an imbalance between the technology’s ability to discover weaknesses and its capacity to produce reliable fixes.
“The providers of large language models have developed AI that is very good at attacking,” Caspers said. He argued that these companies had a responsibility to redirect their efforts towards ensuring that their models could reliably develop security updates. The objective, he added, was not to accept an uncontrollable escalation in cyberattacks but to establish safeguards capable of keeping AI-assisted operations within manageable limits.
The discovery and remediation of the PHP vulnerabilities involved collaboration with OpenAI, raising questions about Europe’s reliance on external AI providers for cybersecurity. Caspers described this dependence as a reality that governments and security organisations must address, while calling for Europe to develop its own defensive capabilities. European language models, including Mistral, could become internationally competitive in cybersecurity if their capabilities were expanded. He also advocated international alliances, including emerging cooperation with Canada.
The interview ended with an unresolved question about when German authorities had first been informed of the vulnerability. Asked about reports that the US government had received information on 16 October, Caspers said the BSI had planned around the expected release of the PHP update on 22 October and had revised its preparations after the vulnerability was leaked online on 20 October. When Die Zeit asked directly whether he had known about the flaw beforehand, he declined to answer: “I do not answer every question.”
