Urgent Patching Underway for AI-Discovered PHP Vulnerabilities Affecting Websites Globally

Governments and corporations worked through the night to implement urgent security updates following the artificial intelligence-assisted discovery of vulnerabilities in PHP, a programming language essential to approximately 70% of websites worldwide. The FBI's cyber division issued a warning that these flaws could enable malicious actors to execute code remotely on PHP platforms, potentially compromising sensitive data and networks. The agency recommended that operators take websites offline if immediate updates were not feasible.

In the United Kingdom, some limited government services experienced temporary disruptions or were taken offline as a precaution. A spokesperson for the prime minister's office stated that experts were collaborating with OpenAI and international partners to address the issue. "No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out," the spokesperson said.

James Sullivan, Director of Cyber and Tech at the Royal United Services Institute in London, explained that the two critical flaws identified by AI could grant unauthenticated access to sites, potentially allowing attackers to control web servers remotely without needing passwords. This could lead to data theft, alteration, or the use of compromised systems for further attacks. Sullivan noted that while taking websites offline for patching is good practice, it is "staggering" that some of these vulnerabilities are more than a decade old.

OpenAI reported that its AI agents played a role in uncovering these vulnerabilities. The company stated that it had led a coalition of researchers and security providers in addressing the PHP flaws over the past two months, calling them "one of the most impactful security issues in recent memory." OpenAI indicated that AI appeared to have discovered these vulnerabilities before malicious actors did.

Sullivan commented on the dual nature of AI in cybersecurity, noting that while it can help attackers find vulnerabilities, it can also aid in their discovery and remediation. He attributed some ongoing website downtime to the availability of multiple patches for different software types, requiring testing to ensure compatibility.

Globally, the impact was visible. Finland's government website indicated that while the disruption had been resolved, some content was still being restored. In Japan, Osaka prefecture's website reported its machine translation service was unavailable due to system failure. The Japanese Prime Minister's office shared a warning advising website administrators to check their PHP usage and install available patches promptly. If immediate patching was not possible, temporarily suspending websites was suggested as an effective risk-reduction measure.

Reports indicated that one vulnerability corrupts system memory, potentially allowing attackers to exploit the system with its own code. The second flaw involves user data being stored instead of removed, which could grant unauthorized access, including downloading or wiping sensitive information. The PHP Foundation confirmed it had released fixes for the vulnerabilities and provided update instructions.

The European Union's cybersecurity agency, ENISA, advised organizations to take immediate action. Sullivan advised against succumbing to a "futuristic scenario where we’re all doomed," emphasizing that basic security practices, such as identifying vulnerable systems, installing updates promptly, and using two-factor authentication, remain crucial for protection against most threats.