LONDON (AP) — Governments and corporations worked throughout the night to update software after the AI-assisted discovery of vulnerabilities in a programming language vital to about 70% of websites globally. Many government sites appeared to be working Thursday, but outages or limited service remained while security work was under way. The FBI’s cyber division warned on Wednesday that the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, which powers websites and web applications. That raised the risk of sensitive data and networks being compromised, said the agency, which recommended that operators take websites offline if they can’t update them immediately.
What to know about the AI-detected security bug impacting wide swaths of the internet
The language that’s known as the backbone of the internet is now subject to what experts are calling the one of the most notable vulnerabilities in recent memory. PHP is the backbone of many websites. It faces significant vulnerabilities, prompting warnings from agencies including the FBI. These vulnerabilities could allow attackers to control web servers without passwords, leading to potential data theft or further attacks. PHP powers about 70% of websites, including WordPress and Drupal, making the exposure vast. Some sites, including government services, have been taken offline to fix the issues. The vulnerabilities have been known since at least 2024, but solutions stalled.
