What happened
Authorities in the United States, Europe and Britain have recommended that websites temporarily go offline until they can be repaired, after severe vulnerabilities were found in PHP, according to NBC News. PHP is a programming language that helps web servers process code, and it underpins a large share of the internet.
The security team that maintains PHP released patches at about 10 a.m. ET on Wednesday. Even so, several websites were down that morning, with operators citing fear that hackers could take them over. The affected sites included Pinboard, a bookmarking service, and some parts of Wikipedia. Two large, largely unmoderated forums, 4Chan and Something Awful, also went offline to wait for a patch.
Japanese websites also took themselves offline voluntarily, including systems for daycare centers and video games, the Japanese tech news site ITmedia reported.
How widely PHP is used
According to W3Techs, which surveys the software behind websites, PHP is used on 69% of all websites. Censys, a company that scans internet infrastructure, counted nearly 55 million web properties running PHP as of Wednesday.
It was unclear how many of those properties had applied the update. Silas Cutler, a principal security researcher at Censys, told NBC News it could be days before it is known how many sites were compromised before they could patch. He said people were "boiling the ocean trying to figure out the how to move from 'All PHP is vulnerable,'" and expected better scoping in a few days.
AI discovery and signs of attacks
OpenAI said it helped discover the vulnerability and brought it to PHP's attention before hackers could exploit it more severely. The company said it found the flaw through a program that gives cybersecurity companies access to ChatGPT models adept at finding software flaws.
"Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory," OpenAI wrote in a blog post Wednesday. It added that the episode shows how AI can uncover flaws with internet-scale impact, but that the same capabilities can help attackers rapidly develop offensive tools and exploits.
It was unclear how heavily hackers were already exploiting the flaws. Patchstack, a cybersecurity platform, said it had received "reports of active exploitation." Cloudflare's chief technical officer wrote on X, "We are seeing early attacks emerging and are updating mitigations as new vectors show up."
Embargo dispute and official guidance
The patch rollout was complicated by an alleged breach of protocol. According to the PHP Foundation, which helps develop and maintain PHP, Chainguard shared details of the patch six hours before its release, violating an embargo agreement. PHP said this made it easier for hackers who saw the post to reverse engineer the fix and keep attacking vulnerable software. Chainguard, which develops open-source software meant to reduce vulnerabilities, did not immediately reply to a request for comment.
Government agencies worldwide, including the U.S. National Security Agency, warned of the flaws and recommended potentially taking sites offline until fixed. CERT-EU said organizations "should consider isolating internet-facing applications from public networks until a fix is available." The U.K.'s National Cyber Security Centre said that where immediate remediation is not feasible, organizations "should consider taking the system offline until it can be fully mitigated."
The Cybersecurity and Infrastructure Security Agency recommended patching in an advisory late Wednesday morning, saying it had "not observed exploitation of these vulnerabilities as of the time of publication."
