NSA, FBI urge websites to go offline amid critical PHP security flaw

US authorities urged website operators to take their sites offline Wednesday (local time) after a critical security vulnerability was discovered in PHP, the programming language used by more than 70 percent of websites worldwide, raising the risk of hacking attacks.

The National Security Agency posted on SNS platform X that day, recommending that "all organizations and companies using PHP in their systems prepare updates to address two critical vulnerabilities."

The NSA added that "these vulnerabilities often provide a path to directly access a server's file system or database," and that "if immediate updates are not possible, we recommend taking the affected systems offline until the vulnerabilities are fully resolved."

The FBI also warned that malicious actors could remotely execute code through PHP, the programming language that powers websites and web applications, and similarly advised operators to take their sites offline if they could not update immediately.

Ismael Valenzuela, a vice president at cybersecurity firm Arctic Wolf, said "a significant portion of the corporate and commercial infrastructure of the internet is exposed to potential risk." While noting that not every website is necessarily vulnerable, he said the situation requires "immediate attention."

Meanwhile, AI systems played a significant role in detecting the PHP security vulnerabilities. The flaws had been flagged in an external audit in 2024, but internal disagreements over how to respond meant early action was not taken.

OpenAI described the flaws as "one of the most impactful security issues in recent memory" and said it had spent the past two months leading a coalition of researchers, security service providers and other stakeholders to address the PHP vulnerabilities.

"While these bugs are indeed serious, they are no more than some of the many critical vulnerabilities we have already discovered and are working to fix," OpenAI said, adding that it expects "a sharp increase in similar vulnerability discoveries over the coming months."

The Associated Press interpreted the PHP case as evidence that, while AI has often been blamed as a cause of security incidents, it can also help identify cybersecurity vulnerabilities.