Some websites go dark as operators address an AI-detected flaw in a web programming language
AI helped researchers find security flaws in a widely used programming language. On Wednesday (Oct 21), governments and other organisations in Europe and the US temporarily took some websites offline while they rushed to install security updates.
The FBI's cyber division warned that attackers could use the flaws to run their own code remotely in PHP, a programming language used to build websites and web applications. This could put private data and computer networks at risk, the agency said. It advised website operators to take their sites offline if they could not update them right away.
For example, the Finnish government's website was only partly available on Wednesday. A message told visitors that government websites were temporarily disrupted and were fully or partly unavailable while officials worked to fix the problem.
"The potential impact is enormous," said Ismael Valenzuela, vice president of labs, threat research and intelligence at cybersecurity firm Arctic Wolf. He added that PHP is used by roughly 70 per cent of websites whose server-side programming language is known.
Valenzuela said the flaws put "a significant portion of the internet's business and commercial infrastructure at potential risk". This does not mean that every website is vulnerable, he explained, but the flaws need "immediate attention".
The PHP Foundation, which includes developers who help keep the programming language secure, said on Wednesday that it had released fixes for the flaws and instructions explaining how to update systems.
AI agents helped discover the flaws. In a blog post, OpenAI said it had led a group of researchers, security companies and other partners in working to address PHP vulnerabilities over the past two months.
"PHP's maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure," the company said.
OpenAI, which is based in San Francisco, called the flaws "one of the most impactful security issues in recent memory". The company said AI appeared to have found the flaws before any attackers did.
"As significant as they are, these bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months," OpenAI said.
AI agents have been blamed for several major security incidents in recent months. These cases have shown that AI itself can have security weaknesses and have raised questions about how to develop the fast-growing technology safely as more people around the world use it. However, experts have also pointed out that AI can help find security flaws, as it did in the PHP case.
"There's an important paradox here. We want AI to move quickly enough to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control," said Raghu Nandakumara, vice president of industry Strategy at cybersecurity company Illumio.
"The faster AI becomes at finding weaknesses, the more important it becomes to think about what happens after those weaknesses are exposed, especially when organisations can't immediately patch every affected system," Nandakumara added. "The lesson isn't that AI is inherently dangerous or inherently protective. It's that speed without control creates a new kind of security problem."
Valenzuela of Arctic Wolf said advances in AI are also changing which flaws are seen as possible to exploit. He noted that some of these flaws had existed for more than a decade.
"What changed wasn't the underlying code, but the ability to find those weaknesses and turn them into working exploits," he said.