Critical vulnerabilities in the programming language that underpins much of the web are so severe that authorities in the United States, Europe and the United Kingdom have recommended that websites be temporarily taken offline until they can be fixed.
The flaws exist in PHP, a little-known but crucial programming language that supports the way Web servers process code. The security team that maintains PHP released a patch to address the issue around 10 a.m. ET.
But as of Wednesday morning, some sites were temporarily shut down, citing concerns that hackers might take over them. These include parts of Pinboard, bookmarking sites and Wikipedia.
Two large but largely unregulated forum sites, 4Chan and Something Awful, are offline awaiting patches.
According to Japanese technology news website ITmedia, Japanese websites have also voluntarily gone offline, including systems for daycare centers and video games.
According to W3Techs’ survey of the software behind the web, 69% of websites use PHP.
As of Wednesday, nearly 55 million web properties were running PHP, according to Censys, a company that specializes in scanning web infrastructure.
But exactly how many restaurants have applied the update is unclear.
Silas Cutler, chief security researcher at Censys, said it could take several days to figure out how many websites were hacked before the vulnerabilities can be patched.
“Right now, people are trying to figure out a way out of ‘all PHP is fragile,'” he told NBC News. “In a few days, there should be better scoping.”
OpenAI said it helped discover the vulnerability and brought it to PHP’s attention before hackers could exploit it more seriously.
“Given the severity of these flaws and the widespread use of PHP, we believe this to be one of the most impactful security issues in recent years,” the company wrote in a blog post on Wednesday.
“It highlights how artificial intelligence can find security vulnerabilities with Internet-scale impact, but the same capabilities can also help attackers quickly develop attack tools and vulnerabilities.”
The company said the flaw was discovered through OpenAI’s program, which gives cybersecurity companies access to ChatGPT models that are good at finding software flaws.
As websites around the world patched the vulnerabilities on Wednesday, it was unclear how severely hackers exploited the flaw. Cybersecurity platform Patchstack said it had received “reports of active exploitation.”
“We are seeing early stage attacks emerging and updating mitigations as new vectors emerge,” the chief technology officer of Cloudflare, one of the web’s largest website hosting companies, wrote on X.
Further complicating efforts to release PHP patches on Wednesday were serious protocol violations allegedly committed by Chainguard, a company that develops open source software designed to reduce cybersecurity vulnerabilities.
According to the PHP Foundation, which develops and maintains PHP code, Chainguard broke its embargo agreement with PHP by sharing details of the patch six hours before its release.
PHP said that by publishing the details of the patch before it is released, Chainguard makes it easier for hackers who see the post to reverse engineer the PHP fix in order to continue attacking the vulnerable software.
Chainguard did not immediately respond to an email requesting comment.
Government agencies around the world, including the U.S. National Security Agency, have warned of the flaws and suggested potentially taking websites offline until the issues are fixed.
CERT-EU, the European Union’s technical cybersecurity advisory body, said: “Organizations should consider isolating Internet-facing applications from public networks until a solution is found.”
The UK’s National Cyber Security Center advises: “If immediate remedial action cannot be taken, organizations should consider taking systems offline until the issue is fully mitigated.”
The Cybersecurity and Infrastructure Security Agency, the main U.S. cybersecurity agency, said in an advisory report on Wednesday morning that it recommended patching the software flaws, but that “these vulnerabilities have not been observed to be exploited as of the time of publication.”