An AI-assisted discovery of vulnerabilities in a widely used programming language led governments and other organizations in Europe and the U.S. to take their websites offline temporarily Wednesday as they scrambled to make security updates.
The FBI’s cyber division warned the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, which powers websites and web applications. That raised the risk of sensitive data and networks being compromised, said the agency, which recommended that operators take websites offline if they can’t update them immediately.
The website of the Finnish government, for one, was only partly available Wednesday. A message to visitors said government websites were experiencing a temporary disruption and were fully or partially unavailable while the issue was being resolved.
“The potential impact is enormous,” said Ismael Valenzuela, vice president of labs, threat research and intelligence at cybersecurity firm Arctic Wolf, adding that PHP powers roughly 70% of websites where the server-side programming language is known.
The exposed vulnerabilities, Valenzuela added, put a “significant portion of the internet’s business and commercial infrastructure at potential risk,” and while it doesn’t mean all websites are vulnerable, the flaws demand “immediate attention”