‘Critical vulnerabilities’ found in computer code supporting up to 70% of internet

“Critical vulnerabilities” in a computer programming language that supports as much as 70 per cent of the internet have caused multiple websites, from Woodie’s DIY to the Finnish government, to suddenly go offline in an effort to protect their systems from cyberattack. The coding issues were discovered by digital agents powered by artificial intelligence (AI) , with the programmers behind the code encouraging all its users “to update immediately” after it was informed of the problem.

The European Union ’s Computer Emergency Response Team (CERT) told users “where that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified”. “Technical details are now being discussed publicly,” CERT said in a statement on Wednesday afternoon, adding that “this raises the likelihood that attacks are already exploiting the vulnerabilities”.

OpenAI , which said it “led a coalition” of researchers investigating the vulnerabilities in question, described the “severity of these flaws” as “one of the most impactful security issues in recent memory”. “To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a defender’s window for maintainers and security providers to prepare fixes and protections ahead of disclosure,” the company, which operates ChatGPT , said in a statement.

PHP, the programmers behind the code, explained there was “a demonstrated exploit” in its system “where an unauthenticated request can trigger the attack before any application code runs”. [ Revolut’s outage was a warning to us all Opens in new window ] “All PHP installations” were “at risk” of a cyberattack, the company warned.

Brian Honan, a Dublin-based cybersecurity expert and chief executive of BH consulting, said “the vulnerabilities are of a very high severity and would actually enable a potential attacker to remotely control and manage a website”. Why is motor insurance so expensive in Ireland? Listen | 32:56 “We don’t have a lot of details just yet because, obviously, if they were to release details of what the vulnerability is, that would enable criminals to hack in before systems are updated and fixed,” he said.

Hackers could “steal data, change websites, do whatever they want”, he said, with “websites liable to be completely taken over”. “It’s not rare for a major vulnerability to be found in software, but I think the impact of this vulnerability will be a surprise ... the impact is huge,” he told The Irish Times.

An incident of this scale “makes it really important for companies to ensure that they understand what cyber systems they have in place”, Honan said, “and that they have a process and tools in place to keep themselves abreast of what potential ways there are to fix those vulnerabilities”. [ Google says its Gemini AI model hacked three other companies Opens in new window ] Howard Shortt, a cyber partner at Grant Thorton , added “there is a real risk that some IT departments overlook this potential threat as they might not realise that it is being used in their systems”.

“If remediation cannot be arranged urgently, then affected systems should be temporarily isolated from external exposure and be subject to heightened monitoring,” he said.