A discovery assisted by artificial intelligence (AI) vulnerabilities in a widely used programming language led governments and other organizations in Europe and the United States to temporarily take their websites offline on Wednesday while they hurried to make security updates.
The cyber division of the Federal Bureau of Investigation (FBI) indicated that vulnerabilities could allow malicious actors to remotely execute code in the PHP programming language (Hypertext Preprocessor), which could put sensitive data and networks at risk, the agency said, recommending that operators take websites offline if they cannot update them immediately.
The Finnish government website, for example, was only partially available on Wednesday. A message told visitors that government websites were experiencing a temporary outage and were fully or partially shut down while the issue was resolved.
“The potential impact is enormous,” he said. Ismael Valenzuelavice president of laboratories, threat research and intelligence at the security firm cybersecurity Arctic Wolfand added that PHP is used on about 70% of websites where the server-side programming language is known.
PHP is an open source programming language (open source) that runs on servers. The scripts (scripts) are processed by the server, which then generates HTML code (Hypertext Markup Language), or the basic language with which pages are generated on the Internet, and displays it to a user.
In addition to generating dynamic content on the Internet, PHP also links to databases, such as MySQL, and works on multiple operating systems (OS).
The exposed vulnerabilities, Valenzuela added, put an “important part of the Internet’s business and commercial infrastructure at potential risk.”and although that does not mean that all websites are vulnerable, the flaws demand “immediate attention.”
The PHP Foundation, which includes programming language developers, said Wednesday that it had released fixes for the vulnerabilities.along with instructions on how to update systems.
AI agents helped discover the vulnerabilities. On a blog, OpenAI stated that led a coalition of researchers, security vendors and others to address vulnerabilities in PHP over the past two months.
“PHP maintainers led the fixes and release, and our teams and partners like Wiz, Cloudflare, and others provided research, technical support, and coordination to prepare protections before release,” the company stated.
San Francisco-based OpenAI called the flaws “one of the most impactful security issues in recent memory.” The company noted that artificial intelligence appeared to have found the vulnerabilities before any attackers.
“As significant as they are, these bugs are part of several important vulnerabilities that we have already found and are working to fix, and we anticipate that similar findings will increase dramatically in the coming months,” OpenAI said.
In recent months, AI agents have been blamed for a series of high-profile security incidents. The episodes have highlighted vulnerabilities in AI security and raised questions about how the rapidly growing technology can be safely developed as its use becomes more widespread globally. But experts also noted that AI can help uncover cyber vulnerabilities, as it did in the case of PHP.
“There is an important paradox. We want AI to act fast enough to find vulnerabilities that humans might miss, while ensuring that increasingly autonomous systems operate within limits that we understand and control,” he said. Raghu Nandakumaravice president of industry strategy at cybersecurity company Illumio.
“The faster AI becomes at finding weaknesses, the more important it becomes to think about what happens after those weaknesses are exposed, especially when organizations cannot immediately patch every affected system.”he added. “The lesson is not that AI is inherently dangerous or inherently protective. It’s that uncontrolled speed creates a new type of safety problem.”
Arctic Wolf’s Valenzuela said AI advances are also changing which flaws are considered “exploitable,” noting that some of these vulnerabilities have existed for more than a decade.
“What changed was not the underlying code, but the ability to find those weaknesses and turn them into code, programs or instructions that can exploit vulnerabilities,” he said.