Cybersecurity experts around the globe are racing to update systems and prevent the most disruptive AI-enabled hack yet discovered. A flaw uncovered in widely used code has made 70 per cent of websites worldwide vulnerable to data theft and defacement.

Government websites in France, Denmark, Finland and the Netherlands when the news emerged.

PHP is a computer language commonly used to power interactive websites, such as the content management system WordPress, which runs news sites and blogs; social networks like Facebook; and key reference tools like Wikipedia. The hack therefore affects websites, rather than individuals鈥� personal computers.

The issue actually involves two flaws, both found by cloud security company Wiz. They relate to how PHP handles errors involving memory: in certain circumstances, data can be left behind after an error, which can then be accessed by a malicious actor. That data can include private information, but it can also allow an attacker to run malicious code.

Every PHP version released in the past decade is affected by at least one of these vulnerabilities, but the PHP Foundation, which oversees development, .

The foundation didn鈥檛 respond to a request for interview, but said in a blog post that signs of the vulnerability emerged in 2024. Yet nothing was done. This is because there was no immediately obvious practical way for hackers to exploit it at the time, and because there was debate about which of several fixes was most appropriate.

Free newsletter

Sign up to The Daily

Sign up to newsletter

鈥淲e won鈥檛 pretend otherwise: the delay was a structural failure, caused by both the security team鈥檚 decision process and its lack of resources,鈥� the PHP Foundation said.

In 2024, the flaw was thought to be impractical to take advantage of, but at the University of Surrey, UK, says AI has moved the goalposts of what is possible since then.

鈥淚t鈥檚 actually very, very difficult to exploit it. It requires millisecond timing,鈥� says Woodward. 鈥淭he reason it was thought to be too complicated was it would have taken a team of people yonks to actually work out the right timings. But what AI does, it doesn鈥檛 go for tea breaks, it doesn鈥檛 go home at 6 o鈥檆lock: you can just set loads of them running and eventually they鈥檒l come up with the right answer of how to exploit it.鈥�

Wiz said in a that there are probably further bugs along similar lines in the PHP code base, which developers will also need to identify and rectify. Wiz didn鈥檛 respond to a request for comment.

People are vibe coding copyrighted apps with AI 鈥� will tech firms sue?

Every time a new technology hits the internet, there is a battle between the rights of users and major companies. To see how this will play out with AI, columnist Jacob Aron looks to examples from the past

Independent cybersecurity expert told the Science Media Centre that two thirds of websites use PHP and may be vulnerable to this latest technique.

鈥淭he key long-term risk with these new vulnerabilities is that organisations fail to implement protections and update software, particularly in legacy systems,鈥� said Ali. 鈥淭he security posture of websites using PHP has dramatically improved over the past decade, but this highlights that this is an ever-present problem 鈥� particularly when AI agents are capable of remorselessly pursuing the goal of finding new vulnerabilities.鈥�

Woodward thinks that while most large websites will have already patched their systems, smaller sites with less expertise and resources could still be vulnerable months or years from now. 鈥淭here will be this long tail and you鈥檒l find some surprising sites have not been patched,鈥� he says.

AI has grown extremely capable in the field of cybersecurity over recent months, which includes working out how to hack computers and how to defend them from hackers, creating a destabilising effect that is yet to reach an equilibrium.

1000 human mathematicians pledge to shun AI in their research

There is a growing backlash against the way AI companies have gone about tackling mathematical problems 鈥� and now some mathematicians are opting to avoid AI altogether

In April, news broke of an unreleased AI model created by Anthropic called Mythos, which the company had kept under wraps because it had been found to be extremely good at hacking. The news sparked panic among cybersecurity experts. NHS England pulled its open-source projects, for instance, over fears Mythos may scour code for flaws and exploit its systems.

Three months later, OpenAI admitted one of its prototype models had escaped a testing environment and hacked another company, Hugging Face. Not to be outdone, that its Claude model had gone rogue and broken into machines at other companies on three occasions.

We even learned from the National Cyber Security Centre, the UK government department tasked with securing the nation鈥檚 IT infrastructure, that the country鈥檚 four main cyber adversaries 鈥� Russia, China, North Korea and Iran 鈥� are using AI to boost their ability to perform 鈥渞elentless鈥� attacks on the UK.

at the University of Wisconsin鈥揗adison has won the 2026 Nobel prize in physics for his work on spotting ghostly particles called neutrinos using a detector at the South Pole.

Neutrinos are subatomic particles that rarely interact with material, are electrically neutral and perfuse the whole universe. Because of this, we can detect neutrinos that originated far away in the cosmos, trace their origin and learn more about the nature of the universe. Cosmic neutrinos are produced when a proton collides with another particle.

If you hold your hand out flat, more than a billion neutrinos will pass through it every second. These originate from the sun, but Halzen鈥檚 work concerns the much more rare and high-energy neutrinos coming from deep within the cosmos and what their detection can tell us about the universe.

Neutrinos act like 鈥済host-like messengers from the cosmos鈥�, said , chair of the Nobel committee for physics, at a press conference. 鈥淚t鈥檚 a way of bringing us information about distant cosmic sources which we鈥檙e unable to acquire in other ways.鈥�

In 1988, Halzen proposed using the Antarctic ice as a neutrino detector, then went on to spearhead an international collaboration of more than 450 people from 58 institutions in 14 countries to make the IceCube Neutrino Observatory a reality.

The detector uses thousands of light sensors buried 2 kilometres under the surface of the ice in deep holes drilled using hot water. As neutrinos shoot through Earth, they interact with the ice, creating what鈥檚 known as Cherenkov radiation and emitting blue light. The network of light sensors allows researchers to trace their trajectory back to their origin point, revealing vital information about their formation.

Subscriber-only newsletter

Sign up to Lost in Space-Time

Sign up to newsletter

Halzen calculated that, if you built a neutrino collector 1 cubic kilometre in size, you would detect one neutrino per day. IceCube was completed in 2010 and began full operations the following year. The first high-energy extraterrestrial neutrinos were detected in 2013.

鈥淲hen I reflect on this moment, I have to emphasise how lucky I was,鈥� said Halzen, addressing the press conference by phone. 鈥淏ecause when we started this project, everybody realised this was maybe a good idea, but very few thought it would work 鈥� including myself. So this was kind of an adventure where success was not guaranteed, and we were lucky to overcome the various challenges. It was a long journey, but finally it worked.鈥�

Halzen said he hopes the prize will reflect on the collaborators who worked on the project in the early days.

The IceCube detector has gone on to make many more discoveries. In 2017, it helped identify the first definitive source for a single high-energy cosmic neutrino: a blazar called TXS 0506+056 that blasted a huge jet of energy towards Earth. In 2023, it identified neutrinos from within our own galaxy, the Milky Way, which are typically overwhelmed by stronger signals from the rest of the universe.

Of winning the award, Halzen said: 鈥淚t was a great surprise and I didn鈥檛 expect it. It鈥檚 a great pleasure.鈥�