Governments and corporations worked throughout the night on urgent security updates after the AI-assisted discovery of vulnerabilities in a programming language vital to 70% of websites globally.
Many government sites appeared to be functioning normally Thursday, but outages or limited service continued while security work was under way.
The FBI’s cyber division warned on Wednesday that the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, which powers websites and web applications. That raised the risk of sensitive data and networks being compromised, said the agency, which recommended that operators take websites offline if they can’t update them immediately.
In Britain some “limited” government services may temporarily be offline while work is carried out to address potential cybersecurity issues, the prime minister’s office said.
“Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue,” a spokeswoman said Thursday.
“No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out, the spokeswoman said.
The two critical flaws identified by AI could allow bad actors to get unauthenticated access to sites which, in theory, could allow them to control a web server remotely without needing a password, said James Sullivan, Director of Cyber and Tech at the Royal United Services Institute in London. That could allow a hacker to steal data, alter data or use the system as a platform from which to launch other attacks, he said.
Taking websites offline while fixing the problem is “good practice,” and appropriate cyber risk management but it’s “staggering” that some of the flaws are more than a decade old, Sullivan said.
Artificial intelligence agents helped uncover the vulnerabilities. In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months.
OpenAI called the flaws “one of the most impactful security issues in recent memory.” It said AI appeared to find the vulnerabilities before any attackers did.
