An AI-assisted discovery of vulnerabilities in a widely used programming language led governments and other organizations in Europe and the U.S. to take their websites offline temporarily Wednesday as they scrambled to make security updates.
The FBI's cyber division warned the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, which powers websites and web applications. That raised the risk of sensitive data and networks being compromised, said the agency, which recommended that operators take websites offline if they can't update them immediately.
The website of the Finnish government, for one, was only partly available Wednesday. A message to visitors said government websites were experiencing a temporary disruption and were fully or partially unavailable while the issue was being resolved.
“The potential impact is enormous,” said Ismael Valenzuela, vice president of labs, threat research and intelligence at cybersecurity firm Arctic Wolf, adding that PHP powers roughly 70% of websites where the server-side programming language is known.
The exposed vulnerabilities, Valenzuela added, put a “significant portion of the internet’s business and commercial infrastructure at potential risk," and while it doesn't mean all websites are vulnerable, the flaws demand “immediate attention”
The PHP Foundation, which includes developers who work on securing the programming language, said Wednesday it had released fixes for the vulnerabilities, along with instructions on how to update systems.
Artificial intelligence agents helped uncover the vulnerabilities. In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months.
“PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure,” the company said.
San Francisco-based OpenAI called the flaws “one of the most impactful security issues in recent memory.” It said AI appeared to find the vulnerabilities before any attackers did.
“As significant as they are, these bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months,” OpenAI said.
AI agents have been blamed for a host of high-profile security incidents in recent months. The episodes have highlighted the vulnerabilities in AI security and raised questions over how the fast-growing technology can be developed safely as its usage becomes more widespread globally. But experts also pointed out that AI can also help with discovering cyber vulnerabilities, as it did in the PHP case.
“There’s an important paradox here. We want AI to move quickly enough to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control," said Raghu Nandakumara, vice president of industry Strategy at cybersecurity company Illumio.
“The faster AI becomes at finding weaknesses, the more important it becomes to think about what happens after those weaknesses are exposed, especially when organizations can’t immediately patch every affected system,” Nandakumara added. "The lesson isn’t that AI is inherently dangerous or inherently protective. It’s that speed without control creates a new kind of security problem.”
Valenzuela, of Arctic Wolf, said AI advances are also changing what flaws are considered “exploitable," noting that some of these vulnerabilities have existed for more than a decade.
“What changed wasn’t the underlying code, but the ability to find those weaknesses and turn them into working exploits,” he said.