Critical vulnerabilities in commonly used web code spark rush to update systems

Crucial vulnerabilities in a programming language that underpins much of the internet are so severe that U.S., European and British authorities have recommended that websites temporarily go offline until they can be fixed.

The flaws are in PHP, a little-known but crucial programming language that powers how web servers process code. The security team that maintains PHP released patches to fix the problem around 10 a.m. ET.

But several websites were temporarily down Wednesday morning, citing fear that hackers could take them over. They included Pinboard, a bookmarking site, and some parts of Wikipedia.

Two massive but largely unmoderated forum sites, 4Chan and Something Awful, both went offline to wait for a patch.

Japanese websites were also voluntarily offline, including systems for daycare centers and video games, the Japanese tech news site ITmedia reported.

PHP is used in 69% of all websites, according to W3Techs, which surveys the software behind how the internet works.

As of Wednesday, nearly 55 million web properties were running PHP, according to Censys, a company that specializes in scanning internet infrastructure.

But just how many of these properties had applied the update was unclear.

It could be days before it’s clear how many sites were hacked before they were able to patch their vulnerabilities, said Silas Cutler, a principal security researcher at Censys.

“Right now, folks are boiling the ocean trying to figure out the how to move from ‘All PHP is vulnerable,’” he told NBC News. “In a few days, there should a better scoping.”

OpenAI said it helped discover the vulnerability and brought it to PHP’s attention before hackers exploited it more severely.

“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” the company wrote in a blog post Wednesday.

For Subscribers

FOR SUBSCRIBERSDOJ weighs election litigation against more states

FOR SUBSCRIBERSGOP Senate hopeful Ashley Hinson balances standing by Trump and standing up to him in Iowa

FOR SUBSCRIBERSInside the reopened U.S. Embassy in Caracas

FOR SUBSCRIBERSAIPAC shifts tactics amid voter frustration with Israel

FOR SUBSCRIBERSThe viral attack ad featuring an estranged mother

FOR SUBSCRIBERSU.S. troops and diplomats evacuating Middle East posts, sources say

FOR SUBSCRIBERSBogus trans youth brochure rattles Texas voters

FOR SUBSCRIBERSWho knew a basket could be sexy? How ‘Wicker’ became fall’s surprise must-see

FOR SUBSCRIBERSExperts explain how an AI kill switch could work

FOR SUBSCRIBERSCalifornia’s billionaire tax faces a mountain of opposition — and not just from the rich

FOR SUBSCRIBERSTrump keeps promising ‘goodies’ on the campaign trail — but only if Republicans win

FOR SUBSCRIBERSPolice records reveal tensions between Cornell investigators and DA years before Jane Doe case

FOR SUBSCRIBERSThe U.S. fertility rate has hit another record low, CDC finds. Is that good or bad?

FOR SUBSCRIBERSViral attack ad featuring candidate’s estranged mother rattles bitter Ohio governor race

FOR SUBSCRIBERSWhy 1 in 5 multiple sclerosis patients like Christina Applegate are misdiagnosed

Slide 1 of 1

“It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.”

For Subscribers

FOR SUBSCRIBERSDOJ weighs election litigation against more states

FOR SUBSCRIBERSGOP Senate hopeful Ashley Hinson balances standing by Trump and standing up to him in Iowa

FOR SUBSCRIBERSInside the reopened U.S. Embassy in Caracas

FOR SUBSCRIBERSAIPAC shifts tactics amid voter frustration with Israel

FOR SUBSCRIBERSThe viral attack ad featuring an estranged mother

FOR SUBSCRIBERSU.S. troops and diplomats evacuating Middle East posts, sources say

FOR SUBSCRIBERSBogus trans youth brochure rattles Texas voters

FOR SUBSCRIBERSWho knew a basket could be sexy? How ‘Wicker’ became fall’s surprise must-see

FOR SUBSCRIBERSExperts explain how an AI kill switch could work

FOR SUBSCRIBERSCalifornia’s billionaire tax faces a mountain of opposition — and not just from the rich

FOR SUBSCRIBERSTrump keeps promising ‘goodies’ on the campaign trail — but only if Republicans win

FOR SUBSCRIBERSPolice records reveal tensions between Cornell investigators and DA years before Jane Doe case

FOR SUBSCRIBERSThe U.S. fertility rate has hit another record low, CDC finds. Is that good or bad?

FOR SUBSCRIBERSViral attack ad featuring candidate’s estranged mother rattles bitter Ohio governor race

FOR SUBSCRIBERSWhy 1 in 5 multiple sclerosis patients like Christina Applegate are misdiagnosed

Slide 1 of 1

The vulnerability was discovered through OpenAI’s program to give cybersecurity companies access to ChatGPT models that are adept at finding software flaws, the company said.

As websites around the world patched the flaws Wednesday, it was unclear how severely hackers were already exploiting them. Patchstack, a cybersecurity platform, said it had received “reports of active exploitation.”

The chief technical officer of Cloudflare, one of the internet’s largest website hosting companies, wrote on X, “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”

Further complicating the effort to release PHP patches Wednesday was a remarkable breach of protocol alleged to have been committed by Chainguard, a company that develops open-source software designed to reduce cybersecurity vulnerabilities.

According to the PHP Foundation, which works to develop and maintain PHP code, Chainguard shared the details of the patch six hours ahead of its release, breaking an embargo agreement with PHP.

By posting the details of the patch ahead of its release, PHP said, Chainguard made it easier for hackers who saw the post to reverse-engineer the PHP fix to keep hacking the vulnerable software.

Chainguard did not immediately reply to an email requesting comment.

Government agencies around the world, including the U.S. National Security Agency, have warned about the flaws and recommended potentially taking sites offline until they’re fixed.

CERT-EU, the European Union’s technical cybersecurity advisory body, said, “Organisations should consider isolating internet-facing applications from public networks until a fix is available.”

The United Kingdom’s National Cyber Security Centre recommended, “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”

The primary U.S. cybersecurity agency, the Cybersecurity and Infrastructure Security Agency, said in an advisory late Wednesday morning that it recommended patching the software flaws but that it had “not observed exploitation of these vulnerabilities as of the time of publication.”