On Oct. 21, the Information, Technology and Consulting office temporarily took down Dartmouth websites and issued a “major incident” report on its webpage for “websites and systems service disruption.” The report followed the Oct. 21 artificial intelligence-assisted discovery of vulnerabilities in PHP: Hypertext Preprocessor — a programming language used to build 70% of websites globally — by cybersecurity firm Wiz Research using OpenAI’s advanced AI models, according to the Associated Press.
An ITC spokesperson did not respond to requests for comment on whether any Dartmouth websites were affected by PHP vulnerabilities but wrote in an email statement to The Dartmouth that the College’s web services were “not affected” by an internet user’s Oct. 20 discovery of compromised Transport Layer Security certificates, or digital credentials used to encrypt websites, which occurred a day prior and was not directly related to the PHP vulnerabilities.
ITC wrote in its Oct. 21 incident report that the office is applying “security fixes as quickly as possible to minimize disruption” caused by an unspecified cybersecurity vulnerability.
“A widespread security vulnerability has been identified that impacts websites and software across the world, including systems at Dartmouth,” ITC wrote. “As a precaution, some Dartmouth websites and websites may be unavailable while patches are applied.”
The incident is still listed as “Identified” on ITC’s live incident status update webpage as of the time of publication. The PHP Foundation — the language’s nonprofit developers — released a patch for the programming language’s vulnerabilities on Oct. 21.
The use of AI tools to find vulnerabilities in PHP — which is “widely used” to build websites across the internet — has become increasingly “common,” according to computer science graduate student Benjamin Kallus GR, who won more than $30,000 in “bug bounties” for finding and patching cybersecurity vulnerabilities in Google products between 2023 and 2025.
“A properly weaponized memory corruption bug can give you control of the computer that’s running the vulnerable software,” Kallus said. “Those have been exploited in the wild by people who have turned bugs into usable exploits and started deploying them against websites that are running unpatched versions of PHP.”
While any College website coded with PHP could be “vulnerable” to weaponized bugs, Dartmouth’s online infrastructure is protected by the fact that it is “internal-facing,” meaning it requires a Dartmouth login, Kallus said.
“I’m not super worried for now about somebody coming from outside and breaking in,” he explained.
Computer science lecturer Vasanta Kommineni said that using a virtual private network, such as Dartmouth’s GlobalProtect VPN, to limit access to institutional websites is a typical “precautionary step” for cybersecurity vulnerabilities.
“Under VPN,” a user would only be able to access “sensitive” websites while “on Dartmouth’s network,” Kommineni said.
Kallus added that the maintenance of open-source internet infrastructure such as PHP is a “perennial problem” because it relies on volunteers.
“There’s an old comic strip of a bunch of blocks that symbolize the internet: There’s one skinny block that’s just some guy in Nebraska, and everything is resting on that one mini block,” Kallus said. “So much of modern technology is maintained by volunteers, which is very cool. What’s less cool is that big companies rely on this infrastructure without contributing back to it.”
A College spokesperson did not respond to requests for comment.
Veda Dua ’30 contributed to reporting.
Isabela PierryIsabela Pierry ’29 is a reporter from New York and is majoring in comparative literature and government.
——————————————————-
Click Here For The Original Source.
