Crucial vulnerabilities in a programming language that underpins much of the internet are so severe that European and British authorities have recommended websites temporarily go offline until they can be fixed.
The flaws are in PHP, a little-known but crucial programming language which powers how web servers process code. The security team that maintains PHP released patches to fix the problem around 10 a.m. ET.
But several websites were temporarily down as of Wednesday morning, citing fear that hackers could take them over. They included Pinboard, a bookmarking site and some parts of Wikipedia.
Two massive but largely unmoderated forum sites, 4Chan and Something Awful, both went offline to wait for a patch.
Japanese websites were also voluntarily offline, including systems for daycare centers and video games, the Japanese tech news site ITmedia reported.
PHP is used in 69% of all websites, according to W3Techs, which surveys the software behind how the internet works.
OpenAI said that it helped discover the vulnerability and brought it to PHP’s attention before hackers exploited it more severely.
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” the company wrote in a blog post Wednesday.
“It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.”
The vulnerability was discovered through OpenAI’s program to give cybersecurity companies access to ChatGPT models that are adept at finding software flaws, the company said.
As websites around the world patched the flaws Wednesday, it was unclear how severely hackers were already exploiting it. Patchstack, a cybersecurity platform, said it had received “reports of active exploitation.”
The chief technical officer of Cloudflare, one of the internet’s largest website hosting companies, wrote on X, “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”
Government agencies around the world, including the U.S. National Security Agency, have warned of the flaws and recommended potentially taking sites offline until they’re fixed.
CERT-EU, the European Union’s technical cybersecurity advisory body, said, “Organisations should consider isolating internet-facing applications from public networks until a fix is available.”
The United Kingdom’s National Cyber Security Centre recommended, “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”
The primary U.S. cybersecurity agency, the Cybersecurity and Infrastructure Security Agency, said in an advisory late Wednesday morning that it recommended patching the software flaws, but that it had “not observed exploitation of these vulnerabilities as of the time of publication.”
