By — Associated Press Associated Press Leave your feedback Share Copy URL https://www.pbs.org/newshour/nation/ai-discovered-a-software-vulnerability-that-could-impact-70-of-websites-worldwide-the-rush-is-on-to-patch-it Email Facebook Twitter LinkedIn Pinterest Tumblr Share on Facebook Share on Twitter AI discovered a software vulnerability that could impact 70% of websites worldwide. The rush is on to patch it Nation Oct 22, 2026 8:51 AM EDT Governments and corporations worked throughout the night to update software after the AI-assisted discovery of vulnerabilities in a programming language vital to about 70% of websites globally. Many government sites appeared to be working Thursday, but outages or limited service remained while security work was under way. READ MORE: China says it will curb tech exports, including AI, citing national security risks The FBI's cyber division warned on Wednesday that the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, which powers websites and web applications. That raised the risk of sensitive data and networks being compromised, said the agency, which recommended that operators take websites offline if they can't update them immediately. Educate your inbox Subscribe to Here’s the Deal, our politics newsletter for analysis you won’t find anywhere else. Enter your email address Subscribe Form error message goes here. Thank you. Please check your inbox to confirm. In Britain some "limited" government services may temporarily be offline while work is carried out to address potential cybersecurity issues, the prime minister's office said. "Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue," a spokeswoman said Thursday. READ MORE: IMF-World Bank meetings focus on global risks and potential benefits of AI "No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out, the spokeswoman said. The government of Finland's website said that the disruption had been resolved, but that "some content is still missing and is currently being restored." The Japanese Prime Minister shared a warning from the government in a social media post, advising website administrators to check if they use PHP and to immediately install a patch that was released late Wednesday. READ MORE: Trump names national intelligence director Jay Clayton to lead a new federal AI task force "If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk," Prime Minister Sanae Takaichi said. In Japan, Osaka prefecture's website said its machine translations service was "unavailable due to a system failure." Chief Cabinet Secretary Minoru Kihara said the government had not received any reports of damage from cyberattacks related to the PHP vulnerability. Parts of some government websites were taken offline temporarily, he said, to minimize risks, "Just to be safe," Kihara said. Cloudflare CEO Matthew Prince said in a social media post that there had been "millions" of attempts to exploit the vulnerability in the hours since it was announced Wednesday. READ MORE: Anthropic and OpenAI sound the alarm on AI safety — and seek to shape how it's controlled The PHP Foundation, which includes developers who work on securing the programming language, said late Wednesday that it had released fixes for the vulnerabilities, along with instructions on how to update systems. Artificial intelligence agents helped uncover the vulnerabilities. In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months. OpenAI called the flaws "one of the most impactful security issues in recent memory." It said AI appeared to find the vulnerabilities before any attackers did. The European Union cybersecurity agency, ENISA, advised "organizations to take immediate action" to address the vulnerabilities. A free press is a cornerstone of a healthy democracy. Support trusted journalism and civil dialogue. Donate now By — Associated Press Associated Press
Governments and corporations worked throughout the night to update software after the AI-assisted discovery of vulnerabilities in a programming language vital to about 70% of websites globally. Many government sites appeared to be working Thursday, but outages or limited service remained while security work was under way. READ MORE: China says it will curb tech exports, including AI, citing national security risks The FBI's cyber division warned on Wednesday that the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, which powers websites and web applications. That raised the risk of sensitive data and networks being compromised, said the agency, which recommended that operators take websites offline if they can't update them immediately. Educate your inbox Subscribe to Here’s the Deal, our politics newsletter for analysis you won’t find anywhere else. Enter your email address Subscribe Form error message goes here. Thank you. Please check your inbox to confirm. In Britain some "limited" government services may temporarily be offline while work is carried out to address potential cybersecurity issues, the prime minister's office said. "Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue," a spokeswoman said Thursday. READ MORE: IMF-World Bank meetings focus on global risks and potential benefits of AI "No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out, the spokeswoman said. The government of Finland's website said that the disruption had been resolved, but that "some content is still missing and is currently being restored." The Japanese Prime Minister shared a warning from the government in a social media post, advising website administrators to check if they use PHP and to immediately install a patch that was released late Wednesday. READ MORE: Trump names national intelligence director Jay Clayton to lead a new federal AI task force "If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk," Prime Minister Sanae Takaichi said. In Japan, Osaka prefecture's website said its machine translations service was "unavailable due to a system failure." Chief Cabinet Secretary Minoru Kihara said the government had not received any reports of damage from cyberattacks related to the PHP vulnerability. Parts of some government websites were taken offline temporarily, he said, to minimize risks, "Just to be safe," Kihara said. Cloudflare CEO Matthew Prince said in a social media post that there had been "millions" of attempts to exploit the vulnerability in the hours since it was announced Wednesday. READ MORE: Anthropic and OpenAI sound the alarm on AI safety — and seek to shape how it's controlled The PHP Foundation, which includes developers who work on securing the programming language, said late Wednesday that it had released fixes for the vulnerabilities, along with instructions on how to update systems. Artificial intelligence agents helped uncover the vulnerabilities. In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months. OpenAI called the flaws "one of the most impactful security issues in recent memory." It said AI appeared to find the vulnerabilities before any attackers did. The European Union cybersecurity agency, ENISA, advised "organizations to take immediate action" to address the vulnerabilities. A free press is a cornerstone of a healthy democracy. Support trusted journalism and civil dialogue. Donate now