Two critical vulnerabilities have been found in PHP infrastructure, an open-source programming language used by about 70 percent of websites worldwide. That has prompted warnings that ordinary users should also brace for possible personal data leaks.

Business Insider reported on Tuesday that OpenAI found the vulnerabilities while conducting research using its AI models. The flaws directly affect website operators and owners. If services such as e-commerce sites that store user information in PHP systems have not applied security updates, attackers could exploit the flaws to access customer information.

The U.S. National Security Agency warned that one of the PHP vulnerabilities could be used to steal sensitive data, disrupt services and penetrate deeper into networks.

Attempts to exploit the flaws also followed. Madeleine Lawrence (매들린 로런스), co-founder of application security platform Aikido Security, said that within a day of the vulnerabilities being disclosed, Cloudflare reported millions of exploitation attempts targeting them. She said even people who do not build software themselves are connected to companies that depend on such systems, and the impact could therefore be widespread.

The market also responded by urging caution in using websites for the time being. Changpeng Zhao (창펑 자오), co-founder of Binance, wrote on X that people should be especially careful over the next few days no matter what websites they visit.

Website operators should apply the security updates released by PHP. PHP is also providing instructions on how to apply the updates on its website.

Ordinary users were advised to strengthen account security. They should not reuse the same password across multiple sites and should use a password manager. It is also recommended to check banks' security notices and enable two-factor authentication for email and bank accounts and for password managers.

Users were also advised to keep automatic updates turned on and restart their computers once a week. Peter Wildford (피터 와일드퍼드), head of policy at the AI Policy Network, wrote on X that people can check what needs updating on a laptop using Claude Code.

Lawrence said there was no need to be swept up in excessive fear. She added that if people have received a data-breach notification, they should respond immediately because their credentials or information could be circulating on the dark web.