Rush is on to patch a software vulnerability that could impact 70% of
websites worldwide
[October 23, 2026] By
EMMA BURROWS and DAVID MCHUGH
LONDON (AP) — Governments and corporations worked throughout the night
on urgent security updates after the AI-assisted discovery of
vulnerabilities in a programming language vital to 70% of websites
globally.
Many government sites appeared to be functioning normally Thursday, but
outages or limited service continued while security work was under way.
The FBI’s cyber division warned on Wednesday that the vulnerabilities
could allow malicious actors to remotely execute code in the programming
language, PHP, which powers websites and web applications. That raised
the risk of sensitive data and networks being compromised, said the
agency, which recommended that operators take websites offline if they
can’t update them immediately.
Cybersecurity experts who spoke to the Associated Press said the impact
of the vulnerabilities discovered would have ripple effects for some
time but said governments were following cyber best practice by taking
down websites while they were patched.
Limited disruptions on government websites
In Britain, some “limited” government services may temporarily be
offline while work is carried out to address potential cybersecurity
issues, the prime minister’s office said.
“Work has already taken place across Government to identify and fix
potential exposures to our systems, and our experts are continuing to
work closely with both OpenAI and international partners on this issue,”
a spokeswoman said Thursday.
“No large public-facing critical services are being affected by the
exercise, but some limited services may temporarily be offline while
security work is carried out," the spokeswoman said.
The government of Finland’s website said that the disruption had been
resolved, but that “some content is still missing and is currently being
restored.”
In Japan, Osaka prefecture’s website said its machine translations
service was “unavailable due to a system failure.”
The Japanese Prime Minister shared a warning from the government in a
social media post, advising website administrators to check if they use
PHP and to immediately install a patch that was released late Wednesday.
“If it is difficult to apply the fix patch promptly, temporarily
suspending websites and similar measures can be considered an effective
way to reduce risk,” Prime Minister Sanae Takaichi said.
Chief Cabinet Secretary Minoru Kihara said the government had not
received any reports of damage from cyberattacks related to the PHP
vulnerability. Parts of some government websites were taken offline
temporarily, he said, to minimize risks “Just to be safe,” Kihara said.
The flaw was not new and potential damage was seen immediately
The two critical flaws identified by AI could allow bad actors to get
unauthenticated access to sites which, in theory, could allow them to
control a web server remotely without needing a password, said James
Sullivan, Director of Cyber and Tech at the Royal United Services
Institute in London. That could allow a hacker to steal data, alter data
or use the system as a platform from which to launch other attacks, he
said.
Taking websites offline while fixing the problem is “good practice,” and
appropriate cyber risk management but it's “staggering” that some of the
flaws are more than a decade old as that's when the software was first
created, Sullivan said.
Artificial intelligence agents helped uncover the vulnerabilities. In a
blog post, OpenAI said it had led a coalition of researchers, security
providers and others to address vulnerabilities in PHP over the past two
months.
OpenAI called the flaws “one of the most impactful security issues in
recent memory.” It said AI appeared to find the vulnerabilities before
any attackers did.
[to top of second column] |
 The vulnerability has been known
about since at least 2024, according to the PHP Foundation, which
accepted some of the blame for not coming up with a fix sooner.
“The delay was a structural failure, caused by both the security
team’s decision process and its lack of resources,” the foundation
said.
Fully resolving the issue could take weeks or months
“The potential blast radius, if you like, of this is frankly,
enormous,” said Charl van der Walt, Head of Security Research at
Orange Cyberdefense.
“What we’re seeing now, I think, is just the very early tremors,
what’s still going to come over the next few weeks and months, is
going to be far more significant,” he said.
That’s because PHP is fundamental to the running of many sites or
web applications and it could be buried deep in things from online
blogs to internet connected toasters to baby cameras, van der Walt
said.
While the software developers need to fix the bugs, all the various
deployments of it also need to be fixed, which requires companies to
recognize they are running the software, he said. Those companies
then need to “identify the systems where it’s being run, identify
who owns those systems and do a risk assessment about when and
whether it can be patched,” van der Walt said.
The most intense period of fixing the problem will likely be over
the next few weeks but it could be “months or years before all the
stragglers are weeded out,” van der Walt said.
AI can help both attackers and defenders
“There's good news and bad news to this,” Sullivan said, explaining
that on the one hand, AI can help attackers to identify new
vulnerabilities but, on the other hand, it can also help uncover and
fix them.
One of the vulnerabilities corrupts a system’s memory which means it
can no longer remember certain bits of data, allowing a potential
hacker to exploit the system with its own code. The other flaw means
user data is stored on the system instead of being removed which
allows a bad actor to potentially access it, including downloading
or wiping it, Sullivan said.
The reason, he said, that some websites may still be down is because
there are multiple patches available for different types of
software, some organizations may still be waiting to receive them,
and they need to be tested to make sure they work.
But van der Walt said although AI can be used to help patch
vulnerabilities, that's not the end of the story. While attackers
can exploit a vulnerability, defenders need to patch it — but the
patch needs to be robust, tested and approved, he said.
In a hypothetical scenario, van der Walt said, there could also be
issues getting to the physical object where software is being run —
such as a medically inserted pacemaker or in-flight entertainment
system on a plane. “The fix is not always as simple as finding the
problem...right now, I think we’re in a window where certainly the
attacker is getting more advantage from the AI than the defender,"
he said.
The PHP Foundation, which includes developers who work on securing
the programming language, said late Wednesday that it had released
fixes for the vulnerabilities, along with instructions on how to
update systems.
The European Union cybersecurity agency, ENISA, advised
“organizations to take immediate action” to address the
vulnerabilities.
But, “we shouldn’t turn this into a futuristic scenario where we’re
all doomed,” said Sullivan.
There are many “basic” steps individuals and companies can take to
protect themselves against most threats, he said, including
identifying systems that could be compromised, installing software
updates and patches as soon as they are released and using
two-factor authentication.
All contents © copyright 2026 Associated Press. All rights reserved |
