Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb

We were warned there might be unexploded bombs from World War Two unearthed during the construction.

In the end, there were none, but procedures were put in place as a precaution and we all had to practice filing into designated safe zones inside our building.

The PHP story feels like the cyber equivalent of an unexploded bomb - I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet.

But the potential threat is so serious that websites around the world have been taken down as a precaution.

Less than two months ago, 100 tech companies wrote an open letter warning the world to adopt a new level of cyber resilience in the age of AI.

The weaknesses found in the PHP programming language, which is used by millions of websites, had been quietly resting there for years and are not easy to exploit.

However, things that are very difficult for humans are increasingly very little trouble for AI.

The tech is getting a lot of credit here for assisting researchers in finding the bugs, and the PHP foundation, which oversees the programming language, was on the case and issued a fix.

From that point the clock started ticking.

"There's a real dilemma," said Prof Alan Woodward from Surrey University.

"Basically you're telling everyone about the problem at the same time and hoping the defenders aren't awake enough to act as soon as the patch is out."

We probably won't know for a while whether it has worked for any criminals, because the companies affected might not be aware yet either.

Gina Neff, Professor of Responsible AI at Queen Mary University, described this as a good news story.

"We've seen how a team of people supported by the large AI company have used AI to find the problem, work for months together to solve it and get everybody ready to be safe and secure," she told the Today Programme on BBC Radio 4.

But the baddies can use AI too, and those same tools are probably churning away right now trying to get in.

Cyber security authorities are warning website owners to fix the weaknesses immediately, but the patch only works on the latest version of PHP, so older sites will need to upgrade first.

For many it may be a significant repair job, so if there's a web developer in your life you may want to send them thoughts, prayers and maybe a strong coffee.