Rush to patch software flaw that could impact 70% of websites worldwide

Governments and corporations worldwide worked through the night on urgent PHP security updates as websites experienced outages and limited service. The FBI warned Wednesday that two vulnerabilities could let attackers remotely execute code, putting sensitive data and networks at risk. Officials in Britain, Finland and Japan reported temporary service disruptions or restoration work. The PHP Foundation released fixes late Wednesday, but experts said resolving the vulnerabilities across all systems could take weeks, months or longer.

The FBI’s cyber division recommended that website operators take sites offline if they could not update them immediately.

Japan’s Prime Minister Sanae Takaichi urged administrators to check whether their sites use PHP and install the patch released late Wednesday.

The PHP Foundation said the vulnerabilities had been known about since at least 2024 and described the delay in fixing them as a structural failure involving its security team’s decision process and lack of resources.

One flaw can corrupt system memory, while the other can leave user data stored on a system where it may be accessed, downloaded or wiped.

The European Union cybersecurity agency, ENISA, advised organizations to take immediate action to address the vulnerabilities.

Published Oct 23, 2026 2:32 am KST

"Cyber Attack" phrase and PHP code appears in this illustration taken Thursday. Reuters-Yonhap

LONDON — Governments and corporations worked throughout the night on urgent security updates after the AI-assisted discovery of vulnerabilities in a programming language vital to 70% of websites globally.

Many government sites appeared to be functioning normally Thursday, but outages or limited service continued while security work was under way.

The FBI’s cyber division warned on Wednesday that the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, which powers websites and web applications. That raised the risk of sensitive data and networks being compromised, said the agency, which recommended that operators take websites offline if they can’t update them immediately.

Cybersecurity experts who spoke to the Associated Press said the impact of the vulnerabilities discovered would have ripple effects for some time but said governments were following cyber best practice by taking down websites while they were patched.

Limited disruptions on government websites

In Britain, some “limited” government services may temporarily be offline while work is carried out to address potential cybersecurity issues, the prime minister’s office said.

“Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue,” a spokeswoman said Thursday.

“No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out," the spokeswoman said.

The government of Finland’s website said that the disruption had been resolved, but that “some content is still missing and is currently being restored.”

In Japan, Osaka prefecture’s website said its machine translations service was “unavailable due to a system failure.”

The Japanese Prime Minister shared a warning from the government in a social media post, advising website administrators to check if they use PHP and to immediately install a patch that was released late Wednesday.

“If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk,” Prime Minister Sanae Takaichi said.

Chief Cabinet Secretary Minoru Kihara said the government had not received any reports of damage from cyberattacks related to the PHP vulnerability. Parts of some government websites were taken offline temporarily, he said, to minimize risks “Just to be safe,” Kihara said.

The flaw was not new and potential damage was seen immediately

The two critical flaws identified by AI could allow bad actors to get unauthenticated access to sites which, in theory, could allow them to control a web server remotely without needing a password, said James Sullivan, Director of Cyber and Tech at the Royal United Services Institute in London. That could allow a hacker to steal data, alter data or use the system as a platform from which to launch other attacks, he said.

Taking websites offline while fixing the problem is “good practice,” and appropriate cyber risk management but it's “staggering” that some of the flaws are more than a decade old as that's when the software was first created, Sullivan said.

Artificial intelligence agents helped uncover the vulnerabilities. In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months.

OpenAI called the flaws “one of the most impactful security issues in recent memory.” It said AI appeared to find the vulnerabilities before any attackers did.

The vulnerability has been known about since at least 2024, according to the PHP Foundation, which accepted some of the blame for not coming up with a fix sooner.

“The delay was a structural failure, caused by both the security team’s decision process and its lack of resources,” the foundation said.

Fully resolving the issue could take weeks or months

“The potential blast radius, if you like, of this is frankly, enormous,” said Charl van der Walt, Head of Security Research at Orange Cyberdefense.

“What we’re seeing now, I think, is just the very early tremors, what’s still going to come over the next few weeks and months, is going to be far more significant,” he said.

That’s because PHP is fundamental to the running of many sites or web applications and it could be buried deep in things from online blogs to internet connected toasters to baby cameras, van der Walt said.

While the software developers need to fix the bugs, all the various deployments of it also need to be fixed, which requires companies to recognize they are running the software, he said. Those companies then need to “identify the systems where it’s being run, identify who owns those systems and do a risk assessment about when and whether it can be patched,” van der Walt said.

The most intense period of fixing the problem will likely be over the next few weeks but it could be “months or years before all the stragglers are weeded out,” van der Walt said.

AI can help both attackers and defenders

“There's good news and bad news to this,” Sullivan said, explaining that on the one hand, AI can help attackers to identify new vulnerabilities but, on the other hand, it can also help uncover and fix them.

One of the vulnerabilities corrupts a system’s memory which means it can no longer remember certain bits of data, allowing a potential hacker to exploit the system with its own code. The other flaw means user data is stored on the system instead of being removed which allows a bad actor to potentially access it, including downloading or wiping it, Sullivan said.

The reason, he said, that some websites may still be down is because there are multiple patches available for different types of software, some organizations may still be waiting to receive them, and they need to be tested to make sure they work.

But van der Walt said although AI can be used to help patch vulnerabilities, that's not the end of the story. While attackers can exploit a vulnerability, defenders need to patch it — but the patch needs to be robust, tested and approved, he said.

In a hypothetical scenario, van der Walt said, there could also be issues getting to the physical object where software is being run — such as a medically inserted pacemaker or in-flight entertainment system on a plane. “The fix is not always as simple as finding the problem...right now, I think we’re in a window where certainly the attacker is getting more advantage from the AI than the defender," he said.

The PHP Foundation, which includes developers who work on securing the programming language, said late Wednesday that it had released fixes for the vulnerabilities, along with instructions on how to update systems.

The European Union cybersecurity agency, ENISA, advised “organizations to take immediate action” to address the vulnerabilities.

But, “we shouldn’t turn this into a futuristic scenario where we’re all doomed,” said Sullivan.

There are many “basic” steps individuals and companies can take to protect themselves against most threats, he said, including identifying systems that could be compromised, installing software updates and patches as soon as they are released and using two-factor authentication.

由于网站出现故障和服务受限，全球各国政府和企业连夜紧急修复 PHP 安全漏洞。美国联邦调查局 (FBI) 周三发出警告，称两个漏洞可能允许攻击者远程执行代码，从而危及敏感数据和网络安全。英国、芬兰和日本的官员报告称，部分服务出现暂时中断或正在进行恢复工作。PHP 基金会于周三晚些时候发布了修复程序，但专家表示，修复所有系统中的漏洞可能需要数周、数月甚至更长时间。

FBI网络部门建议网站运营者，如果无法立即更新网站，则应将网站下线。

日本首相高市早苗敦促网站管理员检查其网站是否使用 PHP，并安装周三晚些时候发布的补丁。

PHP 基金会表示，这些漏洞至少从 2024 年起就已被发现，并将修复这些漏洞的延迟描述为结构性缺陷，涉及其安全团队的决策过程和资源不足。

其中一个缺陷可能会损坏系统内存，而另一个缺陷可能会将用户数据存储在系统中，从而导致数据被访问、下载或擦除。

欧盟网络安全局（ENISA）建议各组织立即采取行动解决这些漏洞。

发布于2026年10月23日凌晨2:32（韩国标准时间）

这张摄于周四的插图显示了“网络攻击”字样和PHP代码。路透社-韩联社

伦敦——人工智能辅助发现一种对全球 70% 的网站至关重要的编程语言存在漏洞后，各国政府和企业连夜紧急开展安全更新工作。

周四，许多政府网站似乎运行正常，但在进行安全工作期间，仍存在服务中断或服务受限的情况。

美国联邦调查局网络部门周三警告称，这些漏洞可能允许恶意行为者远程执行PHP编程语言编写的代码，而PHP正是网站和网络应用程序的底层语言。该机构表示，这增加了敏感数据和网络遭到入侵的风险，并建议网站运营商如果无法立即更新网站，则应将其下线。

接受美联社采访的网络安全专家表示，已发现的漏洞的影响将在一段时间内持续存在，但他们也表示，各国政府正在遵循网络安全最佳实践，在修复漏洞期间关闭网站。

政府网站受到的干扰有限

英国首相办公室表示，在英国，一些“有限的”政府服务可能会暂时离线，以便开展工作解决潜在的网络安全问题。

一位发言人周四表示：“政府各部门已经开展工作，以识别和修复我们系统可能存在的风险，我们的专家正在继续与 OpenAI 和国际合作伙伴就此问题密切合作。”

发言人表示：“此次演习不会影响任何面向公众的大型关键服务，但在进行安全工作期间，一些有限的服务可能会暂时离线。”

芬兰政府网站表示，网络中断问题已经解决，但“部分内容仍然缺失，目前正在恢复中”。

在日本，大阪府的网站称其机器翻译服务“由于系统故障而无法使用”。

日本首相在社交媒体上转发了政府的警告，建议网站管理员检查是否使用了 PHP，并立即安装周三晚些时候发布的补丁。

“如果难以及时应用修复补丁，暂时关闭网站等措施可以被视为降低风险的有效方法，”首相高市早苗表示。

内阁官房长官木原稔表示，政府尚未收到任何与PHP漏洞相关的网络攻击造成损失的报告。他表示，为了尽可能降低风险，“只是为了安全起见”，部分政府网站已暂时下线。

这个缺陷并非新出现的，潜在的损害很快就显现出来。

伦敦皇家联合军种研究所网络与技术主管詹姆斯·沙利文表示，人工智能发现的这两个关键缺陷可能使不法分子获得对网站的未经认证访问权限，理论上，这可以让他们在无需密码的情况下远程控制网络服务器。他指出，这可能使黑客窃取数据、篡改数据，或将该系统用作发起其他攻击的平台。

苏利文表示，在修复问题时将网站下线是“良好的做法”，也是适当的网络风险管理，但令人“震惊”的是，有些缺陷已经存在超过十年了，因为那是该软件最初创建的时间。

人工智能代理帮助发现了这些漏洞。OpenAI 在一篇博客文章中表示，过去两个月里，它牵头组织了一个由研究人员、安全提供商和其他机构组成的联盟，共同解决 PHP 中的漏洞。

OpenAI称这些漏洞是“近年来最具影响力的安全问题之一”。该公司表示，人工智能似乎比任何攻击者都更早发现了这些漏洞。

据 PHP 基金会称，该漏洞至少从 2024 年就已为人所知，该基金会也承认自己未能更早地提出修复方案负有部分责任。

基金会表示：“延误是结构性缺陷造成的，既是由于安保团队的决策过程，也是由于其资源不足。”

彻底解决这个问题可能需要数周或数月时间。

Orange Cyber​​defense 安全研究主管 Charl van der Walt 表示：“坦白说，这件事的潜在爆炸半径非常巨大。”

“我认为，我们现在看到的只是最初的震荡，接下来几周和几个月将会发生更严重的后果，”他说。

范德瓦尔特说，这是因为 PHP 对于许多网站或 Web 应用程序的运行至关重要，它可能深藏在从在线博客到联网烤面包机再到婴儿摄像头等各种事物中。

范德瓦尔特表示，虽然软件开发人员需要修复漏洞，但所有不同的部署版本也需要修复，这就要求企业意识到他们正在运行该软件。这些企业随后需要“识别运行该软件的系统，确定这些系统的所有者，并进行风险评估，以确定何时以及是否可以进行修补”。

范德瓦尔特表示，解决问题的最紧张时期可能将持续数周，但“要彻底清除所有残留人员，可能需要数月甚至数年时间”。

人工智能可以帮助攻击者和防御者。

“这既有好消息也有坏消息，”苏利文解释说，一方面，人工智能可以帮助攻击者识别新的漏洞，但另一方面，它也可以帮助发现和修复这些漏洞。

其中一个漏洞会破坏系统内存，导致系统无法记住某些数据，从而使潜在的黑客能够利用自身代码攻击系统。另一个漏洞则会导致用户数据被存储在系统中而非被删除，这使得恶意行为者有可能访问这些数据，包括下载或擦除数据，苏利文说道。

他说，一些网站可能仍然无法访问的原因是，针对不同类型的软件有多个补丁程序可用，一些组织可能仍在等待接收这些补丁程序，并且需要对其进行测试以确保其有效。

但范德瓦尔特表示，虽然人工智能可以帮助修复漏洞，但这并非故事的全部。攻击者可以利用漏洞，防御者需要修复漏洞——但补丁必须稳健可靠，经过测试和批准，他说道。

范德瓦尔特表示，在假设的场景中，也可能存在难以触及运行软件的物理对象的问题，例如植入人体的心脏起搏器或飞机上的机上娱乐系统。“解决问题并不总是像找到问题那么简单……目前，我认为攻击者利用人工智能获得的优势远大于防御者，”他说道。

PHP 基金会（其成员包括致力于保护该编程语言的开发人员）周三晚些时候表示，已发布漏洞修复程序，并提供了有关如何更新系统的说明。

欧盟网络安全局 (ENISA) 建议“各组织立即采取行动”来解决这些漏洞。

但沙利文说：“我们不应该把这变成一个我们都注定要灭亡的未来场景。”

他表示，个人和公司可以采取许多“基本”措施来保护自己免受大多数威胁，包括识别可能被入侵的系统、在软件更新和补丁发布后立即安装以及使用双因素身份验证。