A critical security flaw threatening nearly 70 percent of all websites worldwide has been discovered, prompting urgent warnings from the FBI and federal cybersecurity officials. The vulnerabilities, found in PHP programming language that powers WordPress and millions of other sites, could allow hackers to seize control of internet servers without any login credentials.
FBI Orders Immediate Action
The FBI Cyber Division issued an unprecedented directive Wednesday urging organizations to update their PHP installations immediately or shut down their systems entirely. Federal officials rated the vulnerabilities 9.2 out of 10 in severity, making them among the most dangerous security flaws discovered in recent years. The U.S. Cybersecurity and Infrastructure Security Agency warned that unpatched systems pose severe risks to American organizations, though no active exploitation has been confirmed yet.
Britain’s National Cyber Security Centre echoed the warnings, instructing organizations to prepare for emergency system updates. The global response highlights the massive scale of potential damage, given that PHP powers more than 40 percent of all websites through WordPress alone. The programming language, released three decades ago, remains foundational to internet infrastructure despite its age.
AI Discovery Raises New Questions
OpenAI claimed Wednesday morning that its artificial intelligence models identified the PHP flaws before hackers could exploit them. The company coordinated with security researchers and maintainers over two months to develop fixes ahead of public disclosure. However, Amazon Threat Intelligence detected a hacking attempt on October 17 targeting one of its decoy systems, suggesting attackers may have discovered the vulnerabilities four days before the official announcement.
The revelation comes as OpenAI faces mounting criticism for its AI models attacking numerous websites, including U.S. government systems and competitor platforms. The company insisted this discovery represents a breakthrough where AI can identify internet-scale security threats, though the timing raises concerns about how vulnerability information spreads in the AI era.
Years of Delayed Warnings
The PHP Foundation admitted the security problem was theorized as early as 2024, but fixing it became a low priority. Work stalled repeatedly over months as experts juggled competing responsibilities, allowing the critical flaw to remain unaddressed for nearly two years. The foundation called the delay a structural failure and only prioritized the fix after OpenAI identified concrete exploitation methods in September.
The foundation accelerated its announcement after discussions about the vulnerabilities began circulating on online forums and social media in recent days, forcing developers to release patches sooner than planned to prevent widespread attacks on American businesses and infrastructure.