Amazon revealed on Wednesday that malicious actors began attempting to exploit newly identified cybersecurity vulnerabilities four days before the flaws were publicly disclosed. The e-commerce and cloud computing giant stated that these vulnerabilities are currently being actively and widely exploited in real-world environments, triggering urgent defensive measures across the globe.
The warning from Amazon came on the same day that the United States National Security Agency and British cybersecurity authorities issued severe alerts, warning that the flaws expose websites worldwide to extreme risks of hacker compromise. The vulnerabilities reportedly remained undetected for over a decade before researchers finally identified them by leveraging artificial intelligence models developed by OpenAI and Google.
The immense potential impact of these flaws underscores how artificial intelligence is fundamentally reshaping the cybersecurity landscape. Earlier this year, major AI firms such as Anthropic and OpenAI introduced advanced models with sophisticated cyber capabilities, drawing warnings from political figures and financial regulators and prompting the U.S. government to temporarily restrict the rollout of certain advanced models.
The technical focus of the alert centers on the programming language known as PHP. On Wednesday, the NSA urged all organizations utilizing PHP to update their systems immediately or take them completely offline until patches could be applied. Developers responsible for maintaining PHP released software updates earlier in the day to address the security holes.
The NSA detailed the nature of the threat, noting that the vulnerabilities frequently allow attackers to gain direct access to a server’s file system or database. The agency advised that if organizations cannot complete the software updates immediately, they should take affected systems offline until the vulnerabilities are completely remediated.
The vulnerabilities were originally discovered by researchers at two cybersecurity firms, Calif and Wiz. According to an estimate by Wiz, a subsidiary of Alphabet, the vulnerable PHP programming language underpins roughly 70 percent of all websites across the internet.
OpenAI issued a statement Wednesday emphasizing the gravity of the situation. Given the severity of the vulnerabilities and the ubiquitous use of PHP, OpenAI characterized the issue as one of the most significant cybersecurity problems to emerge in recent years. The company confirmed that frontier artificial intelligence models succeeded in identifying the vulnerabilities before malicious attackers capitalized on them.
OpenAI added that the incident demonstrates the profound capacity of artificial intelligence to uncover internet-wide security flaws, while simultaneously acknowledging that the same powerful capabilities could assist attackers in swiftly developing attack tools and exploits. OpenAI collaborated with PHP maintainers, Calif, and Wiz to verify the vulnerabilities and help develop appropriate remediation patches.
Government bodies and administrative agencies around the world moved quickly to respond to the crisis. In Europe, several governments temporarily took certain official websites offline while patches for the two security flaws were applied. Meanwhile, the White House announced that federal agencies are actively assessing the potential impact that these vulnerabilities might pose to government systems and critical national infrastructure.
The widespread exposure is largely attributed to the architectural foundation of the modern web. PHP is heavily relied upon across the internet primarily because WordPress, the world’s most widely utilized website construction and content management platform, is written in PHP and depends on the language to function.
The United Kingdom’s National Security Centre echoed international concerns, stating that the vulnerabilities could potentially allow hackers to seize control of website servers without needing a password or any other login credentials. The British agency urged all organizations across the UK to take immediate defensive action.
