The FBI's cyber division warned about vulnerabilities in PHP, a widely used programming language that powers many websites and web applications. According to the agency, these flaws (defects in the code) allow attackers to execute code remotely on servers, creating a risk of compromising data and networks. Operators were advised to take sites offline if they cannot urgently install updates.
As a result, a number of public and private organizations in Europe and the US temporarily took their resources offline. The Finnish government's website worked only partially on Wednesday: visitors saw a message about temporary disruptions until the problem was resolved.
"The potential impact is enormous," said Ismael Valenzuela, vice president of threat research at Arctic Wolf. According to him, PHP is used on roughly 70% of websites that use a server-side programming language at all (code executed on the server rather than in the user's browser). The vulnerabilities put "a significant part of the internet's business and commercial infrastructure" at risk, although not all websites are vulnerable.
The PHP Foundation, which includes the developers responsible for the language's security, said it had released fixes and instructions for updating systems.
Artificial intelligence agents - programs capable of autonomously performing tasks - helped find the vulnerabilities. In a blog post, OpenAI (a company from San Francisco) said that over the past two months it had led a coalition of researchers and security vendors to address the problem in PHP. "The PHP maintainers led the fixes and the release, while our teams and partners such as Wiz, Cloudflare and others provided research, technical support and coordination," the statement says.
OpenAI called these flaws "one of the most significant security issues in recent times." According to the company, AI appears to have found the vulnerabilities before attackers could exploit them. "However significant they may be, these bugs are only some of the serious vulnerabilities we have already found and are working to fix. We expect such findings to increase sharply in the coming months," OpenAI said.
In recent months, AI agents have been blamed for a number of high-profile security incidents. Those cases highlighted vulnerabilities in AI technology itself and raised questions about how to develop it safely as it is used ever more widely. However, experts also noted the benefits: AI can help find cyber vulnerabilities, as happened with PHP.
"There is an important paradox here. We want AI to work fast enough and find vulnerabilities that humans might miss, but at the same time to ensure that increasingly autonomous systems act within boundaries we understand and control," said Raghu Nandakumara, vice president of industry strategy at Illumio. "The faster AI finds weak spots, the more important it is to think about what happens after they are identified, especially when organizations cannot immediately patch all affected systems. The lesson is that speed without control creates a new type of security problem," he added.
Valenzuela of Arctic Wolf noted that the development of AI is also changing the very concept of an "exploitable vulnerability." Some of these flaws have existed for more than a decade. "What has changed is not the code itself, but the ability to find weak spots and turn them into working exploits (programs that use a vulnerability)," he explained.