Authorities in Europe, Asia and other regions have temporarily taken a number of government websites offline to guard against newly discovered security vulnerabilities in PHP, the programming language that underpins the majority of websites on the internet.
On Wednesday, the flaws in PHP prompted a rare public warning from the US National Security Agency (NSA), which advised websites to go offline if they cannot be updated immediately.
"Effective immediately, all organizations using PHP for their systems are advised to prepare for an update addressing two critical vulnerabilities," the NSA said in a social media post.
In Germany, the Digital Ministry said it had taken some websites offline as a precaution. France's Interior Ministry disabled the official websites of local administrative bodies.
Authorities in Belgium, the Netherlands, Finland and the Czech Republic also said they had shut down websites to apply security patches fixing the PHP flaws. Even Japanese Prime Minister Sanae Takaichi posted on social media to warn about the risk.
The pair of vulnerabilities, named PHP2Shell, was discovered by cybersecurity experts with the help of artificial intelligence models.
Researchers at security firm Calif, working with technology company OpenAI, reported the first flaw on August 11. Wiz, a security company owned by technology group Alphabet, reported the second on August 24.
Wiz described the findings as "among the most severe vulnerabilities ever discovered in PHP, and arguably in the history of software."
According to the company, the underlying flaws had existed for decades, but proving they could be exploited required a chain of steps "at the limit of what human researchers could realistically achieve."
AI tools allowed researchers to find the software flaws by testing far more attack scenarios than would be possible relying on human programmers alone.
PHP is maintained by the nonprofit PHP Foundation, which said on Wednesday that the vulnerabilities were among the most serious it had ever encountered.
The group urged anyone running a website to update their source code immediately.
Both flaws rely on accessing memory regions without proper authorization and abusing that access to run malicious code. They allow attackers to execute commands on servers running older PHP code remotely over the internet, without a password or account for legitimate access to the site.
The PHP Foundation also warned that such security weaknesses will become ever easier to find thanks to AI, and called on technology companies to coordinate their response to avoid major disruption to online services.
"Today's tools find bugs faster than ever, for defenders and attackers alike, and the volume of reports will keep rising," the organization said in a statement.
