Software vulnerability could impact 70% of websites worldwide

[AP Photo]

Governments and corporations worked throughout the night on urgent security updates after the AI-assisted discovery of vulnerabilities in a programming language vital to 70% of websites globally.

Many government sites appeared to be functioning normally Thursday, but outages or limited service continued while security work was under way.

The FBI’s cyber division warned on Wednesday that the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, which powers websites and web applications. That raised the risk of sensitive data and networks being compromised, said the agency, which recommended that operators take websites offline if they can’t update them immediately.

In Britain some “limited” government services may temporarily be offline while work is carried out to address potential cybersecurity issues, the prime minister’s office said.

“Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue,” a spokeswoman said Thursday.

“No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out, the spokeswoman said.

The two critical flaws identified by AI could allow bad actors to get unauthenticated access to sites which, in theory, could allow them to control a web server remotely without needing a password, said James Sullivan, Director of Cyber and Tech at the Royal United Services Institute in London. That could allow a hacker to steal data, alter data or use the system as a platform from which to launch other attacks, he said.

Taking websites offline while fixing the problem is “good practice,” and appropriate cyber risk management but it’s “staggering” that some of the flaws are more than a decade old, Sullivan said.

Artificial intelligence agents helped uncover the vulnerabilities. In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months.

OpenAI called the flaws “one of the most impactful security issues in recent memory.” It said AI appeared to find the vulnerabilities before any attackers did.

“There’s good news and bad news to this,” Sullivan said, explaining that on the one hand, AI can help attackers to identify new vulnerabilities but, on the other hand, it can also help uncover and fix them.

The reason, he said, that some websites may still be down is because there are multiple patches available for different types of software, some organizations may still be waiting to receive them and they need to be tested to make sure they work.

The government of Finland’s website said that the disruption had been resolved, but that “some content is still missing and is currently being restored.”

In Japan, Osaka prefecture’s website said its machine translations service was “unavailable due to a system failure.”

The Japanese Prime Minister shared a warning from the government in a social media post, advising website administrators to check if they use PHP and to immediately install a patch that was released late Wednesday.

“If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk,” Prime Minister Sanae Takaichi said.

Chief Cabinet Secretary Minoru Kihara said the government had not received any reports of damage from cyberattacks related to the PHP vulnerability. Parts of some government websites were taken offline temporarily, he said, to minimize risks, “Just to be safe,” Kihara said. DAVID MCHUGH, EMMA BURROWS, LONDON, MDT/AP