What to know about the AI-detected security bug impacting wide swaths of the internet

A computer language that helps run much of the internet has serious security problems. Experts say these are some of the most important security weaknesses found in recent years.

PHP is a computer language used mainly to build websites. It helps run most websites around the world. On Wednesday, the organization responsible for PHP and the FBI's cyber division warned about serious security weaknesses in the language. The warning caused government agencies, companies and other organizations to rush to protect their websites.

The situation also shows how artificial intelligence, or AI, is changing the way people protect websites from cyberattacks.

Here is what we know about the security problems, how they were discovered and what has happened since.

The security weaknesses could allow several kinds of attacks on websites

On Wednesday, the official PHP website and several other organizations and government agencies published security warnings. They told people using PHP to fix two very serious security weaknesses. If they could not make the updates right away, they were told to shut down their websites until they could.

The PHP Foundation, which works to make the development of PHP more open and accountable, said attackers could take advantage of these weaknesses. They could get into websites running PHP without proving who they are or having permission to enter.

James Sullivan, director of cyber and technology at the Royal United Services Institute in London, explained that attackers could control a website's server from somewhere else without needing a password. A server is a computer that helps run a website. Once inside, a hacker could steal information, change information or use the server to attack other systems, he said.

Many websites could be affected, and some are still offline

PHP helps run about 70% of websites worldwide. That means a huge number of websites could be at risk because of these security weaknesses.

PHP is free to use, and its computer code is open for anyone to look at and improve. This helps explain why so many websites use it. PHP is used by WordPress and Drupal, two systems that help people create and manage websites. Governments often use these systems for their websites. PHP is also used by MediaWiki, the software that runs Wikipedia.

After the security warnings came out this week, several websites were temporarily shut down to keep them safe while the problems were fixed. Some government websites and services stopped working normally, including in the United Kingdom, Finland and Japan.

Some websites may still be offline because different kinds of software need different fixes, called patches. Several patches are available, but some organizations may still be waiting to get the ones they need. They also have to test the patches to make sure they work properly.

Charl van der Walt, head of security research at Orange Cyberdefense, believes the problems seen so far are only the beginning. He described them as the "early tremors" of bigger problems that could happen over the coming weeks and months. He said more online services will probably be disrupted as attackers search the internet for systems that have not been fixed.

The security problems may have existed for a long time

According to the PHP Foundation, people have known about these security weaknesses since at least 2024. A security team came up with several different ways to fix them, but each possible solution had problems. At the time, there did not seem to be a clear or practical way for attackers to use the weaknesses to break into systems. Because of this, work on fixing them slowed down, the foundation said.

The PHP Foundation admitted that it should have fixed the problems sooner. It said: "We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources." In other words, the foundation said the delay happened because of how its security team made decisions and because the team did not have enough resources.

Some experts believe the security weaknesses may have been discovered even before 2024.

AI is helping both hackers and the people trying to stop them

People first discovered the security weaknesses, but AI tools helped researchers figure out how attackers could use them. AI also helped researchers test the fixes and check that they worked. In a blog post, OpenAI said it had spent the past two months leading a group of researchers, cybersecurity companies and other organizations working together to fix the PHP weaknesses. Researchers at Wiz, a company that helps protect cloud-based computer systems, also said they had independently used AI to find the weaknesses.

Because AI tools are becoming easier to use, organizations of all sizes now have more powerful ways to look for security problems before attacks happen and respond when threats appear. But attackers can use these same tools to find and take advantage of weak spots in computer systems. AI can help them do this much faster and on a much larger scale.

"It's not quite as easy for defenders as it is for attackers," van der Walt said. He explained that finding a security weakness is only part of the problem. The people protecting a system then have to decide what to replace the unsafe software with. They need to know whether another option exists and whether it has been fixed, thoroughly tested and approved for use.

Sullivan, from the Royal United Services Institute in London, said this ongoing struggle between attackers and defenders can be worrying. But he is paying more attention to the benefits of AI in this case.

"We've actually seen quite a decent use case here where AI can discover some critical vulnerabilities and then the community can come together to remediate them," he said. He meant that AI had helped find serious security weaknesses and that people from different organizations had then worked together to fix them.