US, allies warn of critical vulnerabilities in programming underlying 70% of the internet

Por Maggie Miller and Sam Clark — POLITICO – TOP Stories

The National Security Agency and cyber agencies in Europe, Australia, Canada, and elsewhere on Wednesday urged organizations to take their websites offline immediately after OpenAI tools found critical bugs in a foundational computer programming language.

A series of government and private websites were already taken down on Wednesday, with cyber experts estimating the vulnerabilities could affect up to 70% of the internet.

The National Security Agency, the United Kingdom’s National Cyber Security Centre, the Australian Signals Directorate, the Canadian Centre for Cyber Security and Japanese Prime Minister Sanae Takaichi all posted separate warnings about the vulnerabilities in PHP programming on Wednesday.

PHP is a widely used scripting language that supports much of the internet. The PHP Foundation issued patches for the vulnerabilities on Wednesday, though governments urged action to protect critical websites until issues were fully resolved.

“PHP is widely used for web applications,” the NSA wrote in a post on X. “These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.”

Germany’s cybersecurity agency BSI called PHP a “central building block in web applications.”

Cloud security company Wiz wrote in a blog post on Wednesday that the vulnerabilities could affect up to 70% of the internet because of how many websites use PHP.

Sites across Europe, including the Dutch and Belgian cyber agencies, several Finnish and Dutch government websites, a French domain name organization and the main page of the French tax portal went offline Wednesday.

The NSA noted that it will publish formal guidance on remediating the vulnerabilities “shortly.”

The U.S. Cybersecurity and Infrastructure Security Agency did not respond to a request for comment on the vulnerabilities and, as of publication, had not issued an alert on the threat.

Frontier AI lab OpenAI said on Wednesday that it led a coalition of security groups and researchers for the past two months to address the PHP flaws, which OpenAI said its GPT 5.6-Sol AI model discovered. “Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” it added.

According to internet services organization Cloudflare, another group that worked with OpenAI to respond to the vulnerabilities, these flaws could enable cyberattacks, disrupt networks or leak online data.

Attackers “could succeed in carrying out massive attack campaigns and compromising IT systems from a wide variety of application areas,” Germany’s BSI said on Wednesday, before the fix for the vulnerabilities was released. BSI Vice President Thomas Caspers said at the time that “short-term, large-scale exploitation” was likely.

The fact that organizations are being told to consider taking websites offline “shows how serious this vulnerability is,” said JP Buckley, a partner at law firm Lewis Silkin.

Ciaran Martin, the former head of the British cyber agency, said on LinkedIn on Wednesday that the issue is “very, very bad and requires urgent attention.”

OpenAI noted in its blog post on the incident that “to our knowledge, frontier AI found these vulnerabilities before attackers did, opening a defender’s window for maintainers and security providers to prepare fixes and protections ahead of disclosure.”

Fonte: POLITICO – TOP Stories