The FBI and the National Security Agency warned Wednesday about the discovery of two “critical vulnerabilities” in a widely used programming language that powers websites and web applications.
The FBI's cyber division said the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, potentially compromising sensitive data and networks. It recommended that operators take websites offline if they can't update them immediately.
Several government and other websites were temporarily taken offline so they could be updated with security patches. The website of the Finnish government, for example, was only partly available Wednesday. A message to visitors said government websites were experiencing a temporary disruption and were fully or partially unavailable while the issue was being resolved.
The PHP Foundation, which includes developers who work on securing the programming language, said Wednesday it had released fixes for the vulnerabilities, along with instructions on how to update systems.
Artificial intelligence agents helped uncover the vulnerabilities.
In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months.
“PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure,” the company said.
