Security teams inside governments and large companies worked through the night on urgent software updates after artificial intelligence helped uncover two critical flaws in PHP, the programming language that runs roughly 70% of the world’s websites. Many government sites looked normal on Thursday, but outages and reduced service continued while the fixes went in.

The FBI’s cyber division warned on Wednesday that the flaws could let attackers remotely execute code in PHP, raising the risk of sensitive data and networks being compromised. The agency told operators to take sites offline if they could not patch them straight away.

In Britain, the prime minister’s office said some limited government services might go offline temporarily. “Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue,” a spokeswoman said on Thursday. No large public-facing critical services were affected, she added.

The two flaws could give attackers unauthenticated access to sites, in theory letting them control a web server remotely without a password, said James Sullivan, Director of Cyber and Tech at the Royal United Services Institute in London. From there a hacker could steal data, alter it, or launch further attacks. Taking sites offline during the fix was good practice, he said, though it was “staggering” that some of the flaws were more than a decade old.

OpenAI said in a blog post that it had led a coalition of researchers and security providers to address the PHP flaws over the past two months. It called them “one of the most impactful security issues in recent memory” and said AI appeared to have found them before any attackers did.

“There’s good news and bad news to this,” said Sullivan, noting that AI can help attackers spot new vulnerabilities as well as help uncover and fix them. Some sites were still down, he said, because multiple patches exist for different software, some organisations were still waiting to receive them and the patches need testing before going live.

Finland’s government website said its disruption had been resolved, though “some content is still missing and is currently being restored.” In Japan, Osaka prefecture’s site said its machine translation service was unavailable due to a system failure. Prime Minister Sanae Takaichi shared a government warning urging administrators to check whether they use PHP and to install the patch released late on Wednesday. “If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk,” she said.

Chief Cabinet Secretary Minoru Kihara said the government had received no reports of damage linked to the flaw and that parts of some government websites had been taken offline temporarily, “just to be safe.”

One vulnerability corrupts a system’s memory so it can no longer hold certain data, letting a hacker run their own code. The other stores user data on the system rather than removing it, which could let an attacker download or wipe it, Sullivan said. The PHP Foundation said late on Wednesday that it had released fixes with instructions for updating and the European Union cybersecurity agency ENISA advised organisations to take immediate action.

“We shouldn’t turn this into a futuristic scenario where we’re all doomed,” Sullivan said, pointing to basic steps against most threats: identifying systems that could be compromised, installing updates and patches as soon as they are released and using two-factor authentication.