The City of Fairfax’s public meetings are currently inaccessible online after the platform that hosts its videos and agendas detected a vulnerability in its web programming language.
“Granicus has identified a PHP vulnerability and temporarily took all Media Manager services offline as a precaution, while they assess any potential impact,” the city said in a notice issued this morning (Wednesday).
Recordings and agendas for past meetings of the city council and other governing bodies, along with documents for upcoming meetings, are unavailable for now.
“Our web services provider said the problem will be resolved within 24 hours. No breach, malicious activity, or exploitation detected,” City spokesperson Matthew Kaiser told FFXnow.
Kaiser confirmed that the flaw identified by Granicus is related to vulnerabilities flagged today by the FBI that have affected governments and other organizations across the U.S. and Europe.
The FBI’s cyber division warned the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, which powers websites and web applications. That raised the risk of sensitive data and networks being compromised, said the agency, which recommended that operators take websites offline if they can’t update them immediately.
The website of the Finnish government, for one, was only partly available Wednesday. A message to visitors said government websites were experiencing a temporary disruption and were fully or partially unavailable while the issue was being resolved.
“The potential impact is enormous,” said Ismael Valenzuela, vice president of labs, threat research and intelligence at cybersecurity firm Arctic Wolf, adding that PHP powers roughly 70% of websites where the server-side programming language is known.
The exposed vulnerabilities, Valenzuela added, put a “significant portion of the internet’s business and commercial infrastructure at potential risk,” and while it doesn’t mean all websites are vulnerable, the flaws demand “immediate attention.”
The PHP Foundation, which includes developers who work on securing the programming language, said Wednesday it had released fixes for the vulnerabilities, along with instructions on how to update systems.
Artificial intelligence agents helped uncover the vulnerabilities. In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months.
“PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure,” the company said.
The Town of Vienna, which also uses Granicus to host recordings of its public meetings, might’ve been affected by the PHP vulnerabilities as well. Attempting to access an audio recording of the town council’s work session on Monday (Oct. 19) leads to an “unexpected error” message.
A spokesperson confirmed that the town has been affected by the same issues as Fairfax City.
“In response to the identified PHP security vulnerabilities, Granicus has notified us that it has temporarily taken PHP-based meeting, agenda management and video streaming platforms offline, and the company is actively working on remediating the situation,” spokesperson Karen Thayer said, adding that Granicus has a webpage where it’s providing status updates.
San Francisco-based OpenAI called the flaws “one of the most impactful security issues in recent memory.” It said AI appeared to find the vulnerabilities before any attackers did.
“As significant as they are, these bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months,” OpenAI said.
AI agents have been blamed for a host of high-profile security incidents in recent months. The episodes have highlighted the vulnerabilities in AI security and raised questions over how the fast-growing technology can be developed safely as its usage becomes more widespread globally. But experts also pointed out that AI can also help with discovering cyber vulnerabilities, as it did in the PHP case.
“There’s an important paradox here. We want AI to move quickly enough to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control,” said Raghu Nandakumara, vice president of industry Strategy at cybersecurity company Illumio.
“The faster AI becomes at finding weaknesses, the more important it becomes to think about what happens after those weaknesses are exposed, especially when organizations can’t immediately patch every affected system,” Nandakumara added. “The lesson isn’t that AI is inherently dangerous or inherently protective. It’s that speed without control creates a new kind of security problem.”
Valenzuela, of Arctic Wolf, said AI advances are also changing what flaws are considered “exploitable,” noting that some of these vulnerabilities have existed for more than a decade.
“What changed wasn’t the underlying code, but the ability to find those weaknesses and turn them into working exploits,” he said.
