Vulnerability could impact 70% of websites worldwide
Washington: Governments and corporations worked throughout the night to update software after the AI-assisted discovery of vulnerabilities in a programming language vital to about 70 per cent of websites globally.
Many government sites appeared to be working on Thursday, but outages or limited service remained while security work was underway.
The FBI’s cyber division warned on Wednesday that the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, which powers websites and web applications. That raised the risk of sensitive data and networks being compromised, said the agency, which recommended that operators take websites offline if they can’t update them immediately.
In Britain some “limited” government services may temporarily be offline while work is carried out to address potential cybersecurity issues, the Prime Minister’s Office said.
“Work has already taken place across government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue,” a spokeswoman said on Thursday.
“No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out, the spokeswoman said.
The government of Finland’s website said that the disruption had been resolved, but that “some content is still missing and is currently being restored.”
The Japanese Prime Minister shared a warning from the government in a social media post, advising website administrators to check if they use PHP and to immediately install a patch that was released late Wednesday.
“If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk,” Prime Minister Sanae Takaichi said.
In Japan, Osaka prefecture’s website said its machine translations service was “unavailable due to a system failure.”
Chief Cabinet Secretary Minoru Kihara said the government had not received any reports of damage from cyberattacks related to the PHP vulnerability. Parts of some government websites were taken offline temporarily, he said, to minimise risks, “Just to be safe,” Kihara said.
Cloudflare CEO Matthew Prince said in a social media post that there had been “millions” of attempts to exploit the vulnerability in the hours since it was announced on Wednesday.
The PHP Foundation, which includes developers who work on securing the programming language, said late Wednesday that it had released fixes for the vulnerabilities, along with instructions on how to update systems.
Artificial intelligence agents helped uncover the vulnerabilities. In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months.
OpenAI called the flaws “one of the most impactful security issues in recent memory.” It said AI appeared to find the vulnerabilities before any attackers did.
The European Union cybersecurity agency, ENISA, advised “organisations to take immediate action” to address the vulnerabilities.
