Critical vulnerabilities found in PHP. 70 percent of websites at risk

Approximately 70% of websites worldwide are written in the PHP programming language. Popular website building platforms like WordPress, Drupal, and Joomla run on it. Therefore, a serious error in its code can have consequences far beyond a single company or country.

It was precisely such a problem that Ryan Austin, a researcher at the American company Calif, discovered in August. He was auditing the PHP code using OpenAI's GPT-5.6 Sol artificial intelligence model and found several dangerous vulnerabilities, collectively named PHP2Shell. These are related to how the program manages computer memory and, under certain conditions, allow an attacker to run arbitrary commands on the server. This can lead to gaining control over a website, stealing information, or using a compromised server for attacks on visitors.

Interestingly, these problematic code sections had existed for years. Specialists had paid attention to them decades ago but believed that exploiting such errors for a real hack was too complex. Artificial intelligence helped overcome this barrier. In some cases, a few dozen requests to the server are enough for an attack, and the hack itself can take mere seconds.

Patches prepared in secret

When the head of Calif informed the PHP project representatives about the discovery on August 11, developers immediately started looking for a solution. Cybersecurity specialists, including those from Google and OpenAI, joined the effort. Researchers from Wiz, independently of Calif, also found ways to exploit the vulnerabilities and demonstrated the possibility of attacks on servers running popular content management systems like WordPress, Drupal, and Joomla.

The scale of the work turned out to be enormous. To close the dangerous security gaps, developers had to modify almost 200 files and write more than 10,000 lines of program code. All this time, information about PHP2Shell was kept secret so as not to give attackers hints on how to exploit it before the defense was ready.

There were serious grounds for alarm. According to researchers from Wiz, at least one of the discovered vulnerabilities is present in every PHP version starting from 5.4. However, not all websites using PHP can be exploited, as it depends on server settings and the availability of security updates.

PHP project representatives consider PHP2Shell the most serious security issue in over ten years and compare it to the Heartbleed vulnerability, which forced companies worldwide to urgently update hundreds of thousands of servers in 2014.

Initially, security updates were planned for release on October 22. However, on October 20, information about them leaked to the Hacker News technology forum. Developers decided not to wait and published the updates on October 21.

Now a race with hackers has begun. After the updates are released, attackers can compare the old and new code, identify which errors have been fixed, and try to exploit servers where the protection has not yet been installed. Artificial intelligence can significantly accelerate such analysis.

As Reuters reports, government agencies in the Netherlands and Finland have begun preemptively shutting down websites, not waiting for potential attacks. In the Netherlands, even the website of the National Cyber Security Centre became temporarily unavailable.

The European Union cybersecurity agency CERT-EU recommended that organizations unable to immediately install updates temporarily disable vulnerable websites. Similar recommendations were issued by cybersecurity specialists in the UK, Australia, and Japan.

• 2
• 0
• 4
• 1
• 6
• 0
• 1
• 0