U.S. urges websites to go offline if they cannot update immediately amid PHP hacking emergency

[Financial News] As a critical security vulnerability was discovered in a programming language used by at least 70% of websites worldwide, triggering a hacking alert, U.S. authorities also urged websites on the 21st (local time) to ‘go offline.’
The U.S. National Security Agency (NSA) said that day on the social media platform X: “We recommend that all organizations and businesses using PHP in their systems prepare to install updates to address two critical vulnerabilities.”
The NSA said, “These vulnerabilities often provide a path to direct access to a server’s file system or database,” adding, “If an immediate update is not possible, we recommend taking the affected systems offline until the vulnerabilities are fully addressed.”
The U.S. Federal Bureau of Investigation (FBI) also warned that malicious actors (hackers) could remotely execute code in PHP, a programming language that powers websites and web applications.
The FBI said the risk of sensitive data and networks being compromised had increased, and recommended that operators take their websites offline if they could not update them immediately.
PHP is a programming language widely used in web development and is often called ‘the backbone of the web.’ It powers about 70% of all websites worldwide, including popular platforms such as WordPress and Wikipedia’s MediaWiki.
Ismael Valenzuela, vice president at cybersecurity firm Arctic Wolf, said, “A significant portion of the internet’s corporate and commercial infrastructure is exposed to potential risks.” He stressed that this did not mean every website was vulnerable, but that “immediate attention” was needed.
U.S. media, including the Associated Press, reported that artificial intelligence (AI) systems appear to have played a significant role in detecting PHP security vulnerabilities.
U.S. AI company OpenAI said the flaws were “among the most impactful security issues in recent memory” and that, over the past two months, it had led a coalition of researchers, security service providers, and others to address PHP vulnerabilities.
OpenAI said, “While these bugs are indeed critical, they are only a few of the many critical vulnerabilities we have already discovered and are working to fix,” and predicted that “the number of similar vulnerability discoveries will rise sharply over the coming months.”
The Associated Press noted that while AI has been blamed for security incidents, the PHP case demonstrated that AI can also help identify cybersecurity vulnerabilities.


[email protected] Lee Seok-woo, international affairs correspondent Reporter