Us, Allies Warn Of Critical Vulnerabilities In Programming Underlying 70% Of The Internet

Cyber agencies in the U.S. and across Europe, Australia, Canada and elsewhere Wednesday urged organizations to take their websites offline immediately after OpenAI tools found critical bugs in a foundational computer programming language.

A series of government and private websites were already taken down Wednesday, with cyber experts estimating the vulnerabilities could affect up to 70% of the internet.

The PHP Foundation said in a statement Wednesday that the flaws were leaked before the intended release date through a mixture of mistaken and intentional breaches. Cybersecurity company Chainguard, it said, “unilaterally broke the embargo” and that this action “disregarded weeks of work by many parties toward a coordinated disclosure.”

Chainguard did not immediately respond to a request for comment.

Several U.S. security agencies — including the National Security Agency, the FBI Cyber Division and the Cybersecurity and Infrastructure Security Agency — as well as the United Kingdom’s National Cyber Security Centre, the Australian Signals Directorate, the Canadian Centre for Cyber Security and Japanese Prime Minister Sanae Takaichi all posted separate warnings about the vulnerabilities in PHP programming Wednesday.

PHP is a widely used scripting language that supports much of the internet. The PHP Foundation issued patches for the vulnerabilities Wednesday, though governments urged action to protect critical websites until issues were fully resolved.

“These vulnerabilities often provide a direct path to the server's file system or database,” the NSA wrote in a post on X. “If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.”

CISA said in its statement that while it “has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.” 

Germany’s cybersecurity agency BSI called PHP a "central building block in web applications.”

Cloud security company Wiz wrote in a blog post Wednesday that the vulnerabilities could affect up to 70% of the internet because of how many websites use PHP.

Sites across Europe, including the Dutch and Belgian cyber agencies, several Finnish and Dutch government websites, a French domain name organization and the main page of the French tax portal went offline Wednesday.

Frontier AI lab OpenAI said Wednesday that it led a coalition of security groups and researchers for the past two months to address the PHP flaws, which OpenAI said its GPT 5.6-Sol AI model discovered. “Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” it added.

According to internet services organization Cloudflare, another group that worked with OpenAI to respond to the vulnerabilities, these flaws could enable cyberattacks, disrupt networks or leak online data.

Attackers “could succeed in carrying out massive attack campaigns and compromising IT systems from a wide variety of application areas,” Germany’s BSI said Wednesday, before the fix for the vulnerabilities was released. BSI Vice President Thomas Caspers said at the time that “short-term, large-scale exploitation” was likely.

The fact that organizations are being told to consider taking websites offline "shows how serious this vulnerability is," said JP Buckley, a partner at law firm Lewis Silkin.

Ciaran Martin, the former head of the British cyber agency, said on LinkedIn Wednesday that the issue is “very, very bad and requires urgent attention.”

OpenAI noted in its blog post on the incident that “to our knowledge, frontier AI found these vulnerabilities before attackers did, opening a defender’s window for maintainers and security providers to prepare fixes and protections ahead of disclosure.”