An agency that monitors the programming language PHP issued a severe warning on Tuesday that it had identified two major cybersecurity vulnerabilities. Fixes should have been deployed on Wednesday at 10 a.m. ET, but security experts are urging website administrators to take immediate notice and precautions.
PHP is a free, open-source programming language that much of the web is built on. The warnings are unusually severe, rated 9.2 out of 10. While we don’t have many details about the specifics of the vulnerabilities yet, the concern is that the exploit could be used by bad actors to hack into websites. The vulnerabilities could affect 70% of the world’s websites, according to the Wall Street Journal. That’s why security agencies around the globe, including the US National Security Agency and the UK’s National Cyber Security Centre, are urging website administrators to install the updates or take their sites offline until they are able to patch them.
Cloudflare’s chief technology officer Dane Knecht said Wednesday morning that the company has deployed a fix to its firewall, but it’s still seeing early attacks emerging.
More from CNET
OpenAI said in a blog post on Wednesday that the vulnerabilities in PHP were discovered with its AI model, GPT-5.6 Sol. Wiz, an AI cloud cybersecurity company, also independently identified the vulnerabilities, according to the ChatGPT maker. This incident “highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits,” OpenAI said.
This is a developing story. Check back often for additional updates.