Global cybersecurity effort intensifies after discovery of critical PHP flaws

Governments and corporations have been working around the clock to implement urgent security updates following the AI-assisted discovery of critical PHP vulnerabilities that affect 70% of the world's websites. Most government websites appeared to be functioning normally on Thursday, but some outages or limited service continued while security work was underway.

The FBI's cyber division warned that these vulnerabilities could enable malicious actors to remotely execute code in PHP, which could lead to sensitive data and network compromise. Cybersecurity experts have stated that the impact of these vulnerabilities would have lasting effects, but noted that governments are following best practices by taking down websites while they are being patched.

In Britain, some "limited" government services may temporarily be offline while security work is carried out, according to the prime minister's office. Similarly, the government of Finland reported that its website's disruption had been resolved, but some content was still missing and being restored. In Japan, Osaka prefecture's website reported that its machine translation service was unavailable due to a system failure.

The Japanese Prime Minister advised website administrators to check if they use PHP and to immediately install a patch released late Wednesday. If applying the fix patch promptly is difficult, temporarily suspending websites can help reduce the risk, Prime Minister Sanae Takaichi said. OpenAI, AI's parent company, stated that it led a coalition of researchers, security providers, and others to address PHP vulnerabilities over the past two months.

AI found these vulnerabilities before any attackers did, making them "one of the most impactful security issues in recent memory," OpenAI said. The vulnerabilities have been known since at least 2024, according to the PHP Foundation, which blamed the delay on structural failures in the security team's decision-making process and lack of resources.

Cybersecurity experts warn that the potential blast radius of this vulnerability is enormous, as PHP is fundamental to the running of many sites and web applications. The most intense period of fixing the problem will likely continue over the next few weeks, but it could take months or even years to fully address all the issues.