Websites operated by governments and other organisations in Europe and the United States went temporarily offline on Wednesday as operators rushed to install security updates after artificial intelligence-assisted research uncovered vulnerabilities in a widely used programming language.
The FBI’s cyber division warned that the flaws in PHP, a programming language used to power websites and web applications, could allow malicious actors to execute code remotely.
The vulnerabilities could expose sensitive data and networks to compromise, the agency said, recommending that website operators take their sites offline if they were unable to update them immediately.
The Finnish government’s website, for example, was only partially accessible on Wednesday. A message to visitors said government websites were experiencing temporary disruptions and were fully or partially unavailable while the issue was being resolved.
“The potential impact is enormous,” said Ismael Valenzuela, vice president of labs, threat research and intelligence at cybersecurity firm Arctic Wolf.
He noted that PHP powers roughly 70% of websites for which the server-side programming language is known.
The vulnerabilities put a “significant portion of the internet’s business and commercial infrastructure at potential risk,” Valenzuela said. Although not every website is vulnerable, he stressed that the flaws require “immediate attention”.
The PHP Foundation, which includes developers working to secure the programming language, announced on Wednesday that it had released fixes for the vulnerabilities, along with instructions for updating affected systems.
Artificial intelligence agents helped identify the flaws. In a blog post, OpenAI said it had led a coalition of researchers, cybersecurity providers and other partners over the past two months to address vulnerabilities in PHP.
“PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure,” the company said.
OpenAI, based in San Francisco, described the flaws as “one of the most impactful security issues in recent memory”. The company said AI appeared to have discovered the vulnerabilities before any attackers did.
“As significant as they are, these bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months,” OpenAI said.
AI agents have been blamed for several high-profile security incidents in recent months, highlighting vulnerabilities in AI security and raising questions about how the rapidly advancing technology can be developed safely as its use expands worldwide.
However, experts have also pointed out that AI can help identify cybersecurity weaknesses, as demonstrated by the PHP case.
“There’s an important paradox here. We want AI to move quickly enough to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control,” said Raghu Nandakumara, vice president of industry strategy at cybersecurity firm Illumio.
“The faster AI becomes at finding weaknesses, the more important it becomes to think about what happens after those weaknesses are exposed, especially when organizations can’t immediately patch every affected system,” he added.
“The lesson isn’t that AI is inherently dangerous or inherently protective. It’s that speed without control creates a new kind of security problem.”
Valenzuela said advances in AI were also changing how security experts assess whether flaws could be exploited. Some of the vulnerabilities identified in PHP, he noted, had existed for more than a decade.
“What changed wasn’t the underlying code, but the ability to find those weaknesses and turn them into working exploits,” he said.