A number of high-profile websites around the world have temporarily gone offline as system administrators rush to patch a critical vulnerability in PHP that researchers uncovered using advanced AI tools.

Government bodies in Finland, the Netherlands and elsewhere temporarily disabled access to some online services as they addressed the issue.

The City of Edinburgh Council disabled its website entirely, while the BBC switched off access to some pages, including those for the television programmes and .

Websites offline

Users reported finding some sections of Wikipedia unavailable, and the unmoderated forum 4Chan was also taken offline.

The US National Security Agency recommended organisations to disable websites if they were unable to immediately apply a fix.

“These vulnerabilities often provide a direct path to the server’s file system or database,” the NSA said in an advisory.

The PHP Foundation issued a patch for the issue on Wednesday afternoon, after details of the bug were released ahead of schedule on social media.

Cyber-security companies Calif and Wiz uncovered the issue using advanced AI tools provided by OpenAI under a limited-access programme aimed at finding and repairing flaws. The PHP Foundation is also part of the OpenAI programme.

OpenAI said one of its researchers also found the bug at the same time as the external firms.

Broad deployment

PHP is used by about 69 percent of all websites, according to W3Techs, which surveys internet software.

“Due to the extremely high deployment of PHP based web applications, exploitation in-the-wild is expected,” said cyber-security firm Rapid7.

It recommended updates be carried out “on an emergency basis, outside of normal patch cycles”.

Complicating the situation is that patches are only available for the most recent versions of PHP, while the bug is believed to affect many older versions.

“It’s currently unclear how big the fallout is, and how many third party products use a version of PHP which have no patch available,” said Dan Andrew, head of security at Invader.

“Those that remain exposed should closely follow PHP’s advice that ‘only an update is a complete solution’. So any other mitigation steps are in comparison, generally weaker, and still leave the system vulnerable.”