Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet

Governments and companies around the world are racing to fix vulnerabilities revealed by artificial intelligence that could affect 70% of the world's websites.

Some websites and services briefly went dark after the set of vulnerabilities were announced Wednesday.

The US National Security Agency and Europe's cybersecurity agency advised companies to take immediate action to address two critical flaws in PHP, a programming language that powers 70% of the world's websites. The flaws in PHP were uncovered and addressed by teams at OpenAI, Google-owned cybersecurity company Wiz, and another cybersecurity company, Calif. The underlying flaws had existed for a decade, but exploiting them involved a complex set of steps "at the edge of what human researchers could practically achieve," according to Wiz. Researchers then deployed AI to adapt techniques for taking advantage of those vulnerabilities – known as as "exploits" in cybersecurity – and analyze the results.

The bugs, collectively called PHP2Shell, could allow attackers to break into websites and read memory that could contain sensitive information, like passwords.

The PHP Foundation, the organization behind the coding language, has released a patch for the bugs, which have been hidden in their software for years, and is urging website operators to update their systems immediately. The CEO of Cloudflare said on X that his company's network has observed millions of attempts to exploit the vulnerabilities in the past couple of days.

"With PHP behind such a vast share of the web, the exposure could reach almost everywhere people spend money online," said Nigel Green, the CEO of deVere Group, a financial advisory firm. "Booking platforms, marketplaces, subscription services, ticketing sites, delivery apps and utility portals could all be holding card details on systems built with the same kind of code," he added.

'AI inflection point'

The vulnerabilities involve an issue with how the PHP language works with a computer's memory. When a website request unexpectedly ends, PHP could leave data behind in the memory that can be accessed and potentially corrupted or exposed later.

The flaws could allow attackers to remotely execute code, disrupt services and expose customer data, according to web infrastructure provider Cloudflare, which has been working with the PHP Foundation, Calif, OpenAI and Wiz to address the issue.

"Think of a hotel room where you check out, but your key still works," Patrick Fussell, global head of adversary simulation at IBM, told CNN. "And so you can just go back into that hotel room later, and now somebody else's stuff is there."

The bugs were discovered in late August but were disclosed to the public only on Wednesday, after PHP had come up with a fix.