Some websites temporarily taken offline as operators fix AI-discovered PHP vulnerabilities

AI-assisted discovery of PHP vulnerabilities prompted European and American governments and other organizations to temporarily take websites offline on Wednesday to urgently install security updates. The FBI's cyber division warned that the vulnerabilities could allow malicious actors to execute code remotely in PHP, and advised operators unable to update immediately to take their websites offline; Finnish government websites were only partially available that day. The PHP Foundation has released fixes and update instructions. OpenAI said it led a coalition over the past two months with Wiz, Cloudflare and others to address these vulnerabilities, that PHP maintainers led the fix release, and that AI appeared to have found the vulnerabilities before attackers and that these vulnerabilities are among the most significant security issues recently; it expects similar discoveries to increase sharply in the coming months. Arctic Wolf researchers estimate that PHP accounts for about 70% of websites using known server-side programming languages, that some vulnerabilities have existed for more than a decade, and that what has changed is AI's ability to find weaknesses and turn them into usable attacks.