Rush is on to patch a software vulnerability that could impact 70% of websites worldwide

LONDON (AP) — Governments and corporations worked throughout the night on urgent security updates after the AI-assisted discovery of vulnerabilities in a programming language vital to 70% of websites globally.

Many government sites appeared to be functioning normally Thursday, but outages or limited service continued while security work was under way.

The FBI’s cyber division warned on Wednesday that the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, which powers websites and web applications. That raised the risk of sensitive data and networks being compromised, said the agency, which recommended that operators take websites offline if they can’t update them immediately.

Cybersecurity experts who spoke to the Associated Press said the impact of the vulnerabilities discovered would have ripple effects for some time but said governments were following cyber best practice by taking down websites while they were patched.

Limited disruptions on government websites

In Britain, some “limited” government services may temporarily be offline while work is carried out to address potential cybersecurity issues, the prime minister’s office said.

“Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue,” a spokeswoman said Thursday.

“No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out," the spokeswoman said.

The government of Finland’s website said that the disruption had been resolved, but that “some content is still missing and is currently being restored.”

In Japan, Osaka prefecture’s website said its machine translations service was “unavailable due to a system failure.”

The Japanese Prime Minister shared a warning from the government in a social media post, advising website administrators to check if they use PHP and to immediately install a patch that was released late Wednesday.

“If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk,” Prime Minister Sanae Takaichi said.

Chief Cabinet Secretary Minoru Kihara said the government had not received any reports of damage from cyberattacks related to the PHP vulnerability. Parts of some government websites were taken offline temporarily, he said, to minimize risks “Just to be safe,” Kihara said.

The flaw was not new and potential damage was seen immediately

The two critical flaws identified by AI could allow bad actors to get unauthenticated access to sites which, in theory, could allow them to control a web server remotely without needing a password, said James Sullivan, Director of Cyber and Tech at the Royal United Services Institute in London. That could allow a hacker to steal data, alter data or use the system as a platform from which to launch other attacks, he said.

Taking websites offline while fixing the problem is “good practice,” and appropriate cyber risk management but it's “staggering” that some of the flaws are more than a decade old as that's when the software was first created, Sullivan said.

Artificial intelligence agents helped uncover the vulnerabilities. In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months.

OpenAI called the flaws “one of the most impactful security issues in recent memory.” It said AI appeared to find the vulnerabilities before any attackers did.

The vulnerability has been known about since at least 2024, according to the PHP Foundation, which accepted some of the blame for not coming up with a fix sooner.

“The delay was a structural failure, caused by both the security team’s decision process and its lack of resources,” the foundation said.

Fully resolving the issue could take weeks or months

“The potential blast radius, if you like, of this is frankly, enormous,” said Charl van der Walt, Head of Security Research at Orange Cyberdefense.

“What we’re seeing now, I think, is just the very early tremors, what’s still going to come over the next few weeks and months, is going to be far more significant,” he said.

That’s because PHP is fundamental to the running of many sites or web applications and it could be buried deep in things from online blogs to internet connected toasters to baby cameras, van der Walt said.

While the software developers need to fix the bugs, all the various deployments of it also need to be fixed, which requires companies to recognize they are running the software, he said. Those companies then need to “identify the systems where it’s being run, identify who owns those systems and do a risk assessment about when and whether it can be patched,” van der Walt said.

The most intense period of fixing the problem will likely be over the next few weeks but it could be “months or years before all the stragglers are weeded out,” van der Walt said.

AI can help both attackers and defenders

“There's good news and bad news to this,” Sullivan said, explaining that on the one hand, AI can help attackers to identify new vulnerabilities but, on the other hand, it can also help uncover and fix them.

One of the vulnerabilities corrupts a system’s memory which means it can no longer remember certain bits of data, allowing a potential hacker to exploit the system with its own code. The other flaw means user data is stored on the system instead of being removed which allows a bad actor to potentially access it, including downloading or wiping it, Sullivan said.

The reason, he said, that some websites may still be down is because there are multiple patches available for different types of software, some organizations may still be waiting to receive them, and they need to be tested to make sure they work.

But van der Walt said although AI can be used to help patch vulnerabilities, that's not the end of the story. While attackers can exploit a vulnerability, defenders need to patch it — but the patch needs to be robust, tested and approved, he said.

In a hypothetical scenario, van der Walt said, there could also be issues getting to the physical object where software is being run — such as a medically inserted pacemaker or in-flight entertainment system on a plane. “The fix is not always as simple as finding the problem...right now, I think we’re in a window where certainly the attacker is getting more advantage from the AI than the defender," he said.