Urgent Security Updates Following Vulnerabilities in PHP

LONDON — Governments and corporations engaged in intensive security measures overnight after an AI-assisted detection uncovered critical vulnerabilities in a programming language that powers around 70% of websites worldwide.

While many government websites appeared to be operating normally on Thursday, some outages and limited service persisted as ongoing security efforts took place.

The FBI’s cyber division issued a warning on Wednesday, indicating that these vulnerabilities could enable malicious individuals to remotely execute code in PHP, the programming language in question. This raised concerns regarding the possible compromise of sensitive data and networks. The agency recommended that website operators take their sites offline if they were unable to implement immediate updates.

In Britain, certain “limited” government services might be temporarily unavailable as work progresses to mitigate potential cybersecurity risks, according to the prime minister’s office.

“Measures have already been taken across Government to identify and rectify potential weaknesses in our systems, and our experts are continuing to collaborate closely with both OpenAI and international partners on this issue,” a spokesperson stated on Thursday.

“No major public-facing critical services are currently affected, although some limited services may be temporarily offline while security work is underway,” the spokesperson added.

The two significant vulnerabilities identified could give unauthorized access to websites, theoretically allowing attackers to control a web server remotely without needing a password, according to James Sullivan, Director of Cyber and Tech at the Royal United Services Institute in London. This could enable hackers to steal or alter data and use the system to launch further attacks.

Taking websites offline during the rectification process is considered “good practice” and an appropriate approach to cyber risk management. However, Sullivan noted it’s surprising that some of these flaws have existed for over a decade.

Artificial intelligence was instrumental in uncovering these vulnerabilities. OpenAI revealed in a blog post that it led a coalition of researchers and security providers to tackle PHP vulnerabilities during the past two months.

OpenAI termed these flaws “one of the most significant security issues in recent memory,” stating that AI seemed to have identified the vulnerabilities before they could be exploited by attackers.

The PHP Foundation acknowledged that the vulnerabilities had been known since at least 2024 and accepted part of the responsibility for the delay in implementing a fix.

The foundation attributed this delay to a structural failure linked to decision-making processes and a lack of resources within the security team.

Sullivan mentioned that the perceived lack of urgency in finding a patch might stem from the belief that the design flaws were not a critical risk.

“There’s both good news and bad news here,” Sullivan reflected, highlighting that while AI can aid attackers in identifying vulnerabilities, it can also be a tool for uncovering and addressing them.

Some websites may still be down because various patches are available for different software types, and some organizations may still be awaiting these updates, which need thorough testing to ensure functionality.

Finland’s government website stated the disruption had been addressed, although “some content is still missing and is currently being restored.”

In Japan, the Osaka prefecture’s site reported its machine translation service was “unavailable due to a system failure.”

The Japanese Prime Minister issued a warning via social media, advising website admins to check their PHP usage and to promptly install a patch that was released late Wednesday.

“If applying the fix patch quickly is challenging, temporarily suspending websites and similar countermeasures can be an effective way to reduce risk,” Prime Minister Sanae Takaichi remarked.

Chief Cabinet Secretary Minoru Kihara stated that the government had not received any reports of damage from cyberattacks linked to the PHP vulnerabilities. Some government websites were temporarily taken offline to minimize risks, with Kihara saying, “Just to be safe.”

One vulnerability affects a system’s memory, leading it to forget certain data, which could allow a hacker to exploit the system with its own code. The other flaw permits user data to be retained in the system instead of being deleted, potentially enabling unauthorized access to this data, Sullivan explained.

The PHP Foundation, which includes developers working on securing the programming language, announced late Wednesday that it had released fixes for these vulnerabilities, along with guidelines for updating systems.

The European Union’s cybersecurity agency, ENISA, urged organizations to take immediate steps to address these vulnerabilities.

“We shouldn’t depict this as a worst-case, dystopian scenario,” Sullivan suggested. He emphasized that many “basic” measures can be taken by individuals and businesses to protect against various threats, such as identifying vulnerable systems, promptly installing updates and patches, and implementing two-factor authentication.