US security agencies warn of "critical vulnerabilities" in a widely used programming language

Washington, Oct 21 (KUNA) — Several U.S. security agencies warned on Wednesday of “critical vulnerabilities” in a widely used core programming language for websites, following their discovery by tools developed by OpenAI. The United States joined Canada, Australia, Japan, and European countries in issuing similar warnings, after several government and private websites had already been taken offline in multiple countries.

The U.S. National Security Agency (NSA) posted on the social media platform X: “We advise all organizations using PHP in their systems, effective immediately, to prepare for an update that addresses two critical security vulnerabilities.” It noted that the language “is widely used in web applications, and these vulnerabilities often allow direct access to the server’s file system or database.” The agency recommended that “if the update cannot be applied immediately,” systems should be “taken offline (disconnected from the network) until the vulnerabilities are fully remediated,” adding that “more detailed guidance will be provided shortly.”

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) stated in a bulletin that “no exploitation of these vulnerabilities has been detected as of the time of this bulletin, but they remain a risk to organizations if left unpatched.”

OpenAI said in a statement that it led “an alliance of security groups and researchers over the past two months to address vulnerabilities in the PHP programming language, which were discovered by the company’s AI model.” The company added, “Given the severity of these vulnerabilities and the widespread use of PHP, we consider this issue one of the most impactful security incidents in recent times.” It confirmed that its model “discovered these vulnerabilities before attackers found them.”

According to Cloudflare, one of the entities that collaborated with OpenAI to address the vulnerabilities, “these flaws could enable cyberattacks, disrupt networks, or leak data online.”

The PHP Foundation, in a statement, said that details of the vulnerabilities “were leaked ahead of the scheduled disclosure date due to a combination of errors and deliberate breaches.” It pointed out that cybersecurity firm Check Point “violated the unilateral embargo,” an action that “ignored weeks of work by multiple parties aimed at coordinated disclosure.”

PHP is a widely used scripting language that supports a large portion of the internet. Although it released updates (patches) on Wednesday to address the vulnerabilities, it urged governments and organizations to take immediate action to protect critical sites until the issues are fully resolved.

Cloud security firm Wiz indicated that the vulnerabilities could affect up to 70 percent of the internet, given the large number of websites relying on PHP.

Websites across Europe, including those belonging to cybersecurity agencies in the Netherlands and Belgium, Finnish and Dutch government sites, a French domain name organization, and the homepage of the French tax portal, were taken offline, prompting authorities to suspend their operations. (End) R.S.R