‘Game of cat and mouse’: Digital Policy Office urges immediate patching as AI-discovered PHP flaws threaten global web

Hong Kong’s Digital Policy Office has urged government departments, bureaus and other public organisations to perform immediate security reviews after vulnerabilities were found in the PHP web programming language.

It urged potentially affected bodies to conduct reviews “to check whether their information systems had been affected and complete all patching work as soon as possible; otherwise, the relevant systems should be temporarily taken offline or isolated to reduce the risk of malicious intrusion,” according to a Thursday press release.

As of Friday, no cyber security incidents had yet been reported. The Digital Policy Office said it had already completed the required fixes for the hosting service that hosts government websites.

The security flaws were discovered by AI, with a fix issued on Wednesday afternoon. According to the BBC, cyber security firm Wiz said they were the “most severe vulnerabilities ever discovered” by the technology, while OpenAI said the discovery was “one of the most impactful security issues in recent memory.”

The flaws could provide a direct path to a server’s database or file system, allowing attackers to bypass security checks.

Mart van de Ven, a technologist at HYPE.hk, told HKFP on Friday that the government’s approach was correct: “It’s a game of cat and mouse – and sadly as site owners, we are the mouse. Even if you are fast enough, there’s always a chance of catching a stray swipe of the paw; and if you are too slow, you’re all but guaranteed to be lunch. The bulletin covered the right course of action, but 48 hours in a world of AI cats makes for a tasty mouse.”

Patch the Planet

Under an OpenAI programme called Patch the Planet, cybersecurity researchers at Wiz and Calif linked up with the PHP Foundation to allow advanced AI tools to dig out and fix issues in the web development language. The PHP flaws had been undetected for over a decade, but were uncovered in a matter of weeks.

Wiz said in a blog post that around 70 per cent of the internet may be affected.

The fix was rushed out on Wednesday after news of the vulnerabilities leaked on social media the day before.

PHP can run underneath websites, hosting platforms, content management tools, and other third-party products. It quietly powers platforms such as WordPress, Drupal, and Joomla.

Those rolling out the software patch would need to ensure they are running the latest version of PHP, a task which some organisations may find complicated.

In a post on X on Wednesday, Chief Technology Officer Dane Knecht from internet infrastructure firm Cloudflare said: “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”

Safeguard press freedom; keep HKFP free for all readers by supporting our team

Support HKFP  |  Policies & Ethics  |  Error/typo?  |  Contact  |  Newsletter  | Transparency & Annual Report | Apps

Make a one-off donation.

Tom founded Hong Kong Free Press in 2015 as the city's first crowdfunded newspaper. He has a BA in Communications and New Media from Leeds University and an MA in Journalism from the University of Hong Kong. He previously founded an NGO advocating for domestic worker rights, and has contributed to the BBC, Deutsche Welle, Al-Jazeera and others.

Tom leads HKFP – raising funds, managing the team and navigating risk – whilst regularly speaking on press freedom, ethics and media funding at industry events, schools and conferences around the world.