FBI warns remote code execution could compromise sensitive data and networks
Governments and corporations worked throughout the night on urgent security updates after vulnerabilities in PHP, a programming language vital to 70% of websites globally, were discovered with AI assistance. Emma Burrows reported for The Associated Press from London that both governments and corporations took part in the work and that security work was still under way on Thursday.
The FBI’s cyber division issued the warning on Wednesday, saying the vulnerabilities could allow malicious actors to remotely execute code in PHP, the language that powers websites and web applications. The agency said that possibility raised the risk of sensitive data and networks being compromised.
The FBI recommended that operators take websites offline if they could not update them immediately. For administrators of PHP-based sites, the advisory set out a narrow choice: install the urgent security update, or withdraw the site from service until the fix was in place.
That guidance framed the overnight response, with governments and corporations working on the updates through the night and sites either patched or taken down while the work continued. The breadth of the response followed the breadth of the software, since the language sits underneath a large share of the web.
By Thursday, many government sites appeared to be functioning normally, the Associated Press reported. Outages or limited service continued at other sites while the security work was under way.
In Britain, some “limited” government services might be temporarily offline while work was carried out to address potential cybersecurity issues, the prime minister’s office said. A spokeswoman said work had already taken place across government to identify and fix potential system exposures and that British experts were continuing to work closely with OpenAI and international partners. The office said, “No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out.”
The government of Finland’s website said the disruption had been resolved, but some content was still missing and was being restored. In Japan, Osaka prefecture’s website said its machine-translation service was unavailable because of a system failure.
Japanese Prime Minister Sanae Takaichi shared a warning from the government in a social media post, advising website administrators to check whether they used PHP and to immediately install a patch released late Wednesday. She said, “If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk.” Chief Cabinet Secretary Minoru Kihara said the government had received no reports of damage from cyberattacks related to the PHP vulnerability. Parts of some government websites were taken offline temporarily to minimize risks, he said, “Just to be safe.”
Cybersecurity experts who spoke to The Associated Press said governments were following cyber best practice by taking down websites while they were patched. That approach matched the FBI’s guidance for operators unable to update immediately.
The experts also said the impact of the discovered vulnerabilities would have ripple effects for some time. The FBI’s advisory left operators with an interim standard: update as quickly as possible, and keep the site offline where an immediate update is not available.
James Sullivan, Director of Cyber and Tech at the Royal United Services Institute in London, said the two critical flaws identified by AI could allow bad actors to obtain unauthenticated access to sites. That access could, in theory, let them control a web server remotely without a password, steal or alter data, or use the system as a platform for other attacks. Taking websites offline while fixing the problem was “good practice” and appropriate cyber risk management, Sullivan said. He called it “staggering” that some flaws were more than a decade old, because that was when the software was first created.
Artificial intelligence agents helped uncover the vulnerabilities, OpenAI said in a blog post. The company said it had led a coalition of researchers, security providers and others to address PHP vulnerabilities over the previous two months. OpenAI called the flaws “one of the most impactful security issues in recent memory” and said AI appeared to find the vulnerabilities before any attackers did.
The PHP Foundation, which includes developers who work on securing PHP, said the vulnerability had been known since at least 2024 and accepted some of the blame for not producing a fix sooner. The foundation said, “The delay was a structural failure, caused by both the security team’s decision process and its lack of resources.”
Charl van der Walt, Head of Security Research at Orange Cyberdefense, called the potential blast radius “enormous.” He said what was happening then represented the “very early tremors,” and that developments over the next few weeks and months would be far more significant. Van der Walt said PHP was fundamental to running many sites and web applications and could be buried deep in products ranging from online blogs to internet-connected toasters and baby cameras.
Fixing the developers’ code would not finish the job, van der Walt said. Companies also needed to recognize that they were running PHP, identify the systems where it ran and who owned those systems, and assess the risk and when or whether each system could be patched. The most intense period of fixing the problem was likely to last the next few weeks, but it could be “months or years before all the stragglers are weeded out,” van der Walt said.
Sullivan said AI can help attackers identify new vulnerabilities, but it can also help defenders uncover and fix them. One vulnerability corrupts a system’s memory, meaning it can no longer remember certain bits of data and potentially allowing a hacker to exploit the system with its own code, Sullivan said. The other flaw stores user data on the system instead of removing it, potentially allowing a bad actor to access, download or wipe it.
Some websites may remain down because multiple patches are available for different types of software, some organizations may still be waiting to receive them, and the patches need to be tested to ensure they work, Sullivan said. Van der Walt said AI could help defenders patch vulnerabilities, but attackers could exploit a flaw while defenders still had to patch it, and the patch needed to be robust, tested and approved. He described a hypothetical difficulty reaching the physical object where software runs, such as a medically inserted pacemaker or an in-flight entertainment system on a plane, and said the fix was not always as simple as finding the problem. Van der Walt said he thought attackers were currently getting more advantage from AI than defenders.
The PHP Foundation said late Wednesday that it had released fixes for the vulnerabilities along with instructions on updating systems. The European Union cybersecurity agency, ENISA, advised “organizations to take immediate action” to address the vulnerabilities. Sullivan said individuals and companies could take several basic steps against most threats: identify systems that could be compromised, install software updates and patches as soon as they were released, and use two-factor authentication. He warned against treating the issue as a futuristic scenario in which everyone was doomed.