Security researchers using OpenAI’s advanced artificial intelligence models unearthed major bugs in a piece of software used widely across the internet, setting off fears around the world about significant disruptions for consumers and businesses.
The Trump administration and some governments in Europe and Asia warned that all organizations that rely on the software, which is known as PHP, should immediately install updates released Wednesday to patch the flaws. By some estimates, about 70 percent of all websites and web applications use the software. Recent data suggests its adoption is waning.
While the fixes are readily available, their public release creates a kind of road map for hackers, who could easily reverse engineer the patches in order to initiate attacks before businesses, governments and people can protect their systems. Successful attacks could allow hackers to take control of servers, steal private data and deface websites, experts said.
Security agencies, including the National Security Agency, advised companies to take their systems offline if a patch could not be immediately applied, an effort to prevent hackers from attacking. Some government sites in Europe took those steps, rendering some services unavailable.
The disclosure further heightened concerns that have been building over the last six months about A.I.’s potential to upend cybersecurity unless security shortcomings are addressed.
“We have an urgent request for everyone to take action tonight,” Sanae Takaichi, the prime minister of Japan, said on social media. “If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk.”
PHP is an open-source programming language that helps run website and internet applications. The nonprofit foundation that oversees PHP released a patch Wednesday morning, and security experts said that correctly applying the fix should protect websites from harm. But companies big and small, especially those with short-staffed security teams, can often be slow to adopt new patches.
Those kinds of delays, the widespread use of PHP and the ease with which hackers can move to target many organizations have prompted security professionals to warn that the fallout could be significant.
“With A.I., patching is now an emergency,” said Cynthia Kaiser, a former senior F.B.I. official who oversaw cybersecurity cases and now works at the technology company Halcyon.
The researchers who discovered the bugs work at Calif, a small U.S.-based company of cybersecurity experts who test cutting-edge A.I. models to see what kind of cyberattacks they can identify and build. Their efforts help alert network defenders to undetected problems in order to fix them before malicious hackers can do damage.
Calif said that it discovered the PHP bugs in only a matter of days. Its researchers used GPT-5.6 Sol for the initial findings, and an unreleased OpenAI model for the exploitation of the flaws.
Security researchers said the flaw was concerning given the pervasiveness of the software. In a blog post, OpenAI confirmed that Calif had used its models, and that Wiz, another security company owned by Google, had also independently discovered and reported the vulnerabilities.
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said. “It highlights how A.I. can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.”
The PHP problem was just the latest discovery by Calif, which is among a select group of companies, government agencies and research organizations given early access to advanced A.I. models before they are released publicly. Earlier this year, Calif developed a worm in China’s WeChat communications platform that could have allowed a hacker to rapidly compromise virtually any WeChat account just by calling it. It also used an early version of the Mythos model to bypass security protocols in Apple’s macOS operating system, long viewed as highly secure and difficult to breach.
Those discoveries were relatively contained in their real-world consequences. But the PHP flaws could create lingering problems because of how hackers can recreate the attack and the ubiquity of the software at issue. PHP is a decades-old language that was shorthand for “Personal Home Page,” and is a critical ingredient in popular services like WordPress and Drupal.
Still, data from Shodan, a search engine that scans computer systems across the globe to identify the technologies they run, shows that the adoption of PHP is declining. Many newer websites are built using technologies not vulnerable to this attack.
But some security experts said the bug was potentially one of the most serious found in recent memory, and one of the most significant to date identified by A.I.
“It is certainly one of the most critical bugs of the year,” said Bruce Dang, a researcher at Calif, adding that “the impact will be felt for a while.”
Aaron Krolik contributed reporting from New York.
The post A.I. Discovered a Critical Security Flaw Underpinning Websites appeared first on New York Times.
