Ars Technica reports that attackers gained a four-day head start on a massive PHP2Shell vulnerability that threatens servers worldwide. Researchers at two US cybersecurity groups, Calif and Wiz, uncovered the flaws, while Alphabet-owned Wiz estimated that the affected programming language powers about 70 percent of all websites across the globe.
Key takeaways
- Calif and Wiz discovered the security flaws affecting the programming language.
- Alphabet-owned Wiz estimates the affected language powers roughly 70 percent of all websites.
- OpenAI stated frontier AI found the vulnerabilities before attackers did.
- The UK National Cyber Security Centre urged organizations to take immediate action.
How did the PHP2Shell vulnerability emerge?
Researchers at Calif and Wiz found the flaws, which OpenAI said on Wednesday were considered one of the most impactful security issues in recent memory. OpenAI also noted that frontier AI found these vulnerabilities before attackers did, though the lab worked with PHP, Calif, and Wiz to verify the bugs and develop patches. Because WordPress runs primarily on PHP, the widespread use of that website-building platform amplifies the reach of the problem.
What are the risks according to the NSA warning?
The NSA stated that these vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, the agency recommended that organizations take the system offline until full mitigation happens. Meanwhile, the UK National Cyber Security Centre warned that the bugs could allow a hacker to take control of a server without needing a password or login credentials, prompting calls for immediate action.
What happens next?
The White House stated that federal agencies are currently assessing the potential impacts of the bugs on government systems and critical infrastructure. OpenAI observed that the situation highlights how AI can uncover security flaws with internet-scale impact, but also noted that the same capabilities can help attackers rapidly develop offensive tools and exploits. Organizations everywhere are sorting through patches and mitigation steps to secure affected servers.
Need help moving off old PHP?
If your site runs PHP 8.1 or older, it cannot get the PHP2Shell fix. We upgrade it to a patched PHP 8.4 in 7 days: PHP 5.6, PHP 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 to PHP 8.4. On PHP 8.2 or 8.3, patch now and plan the PHP 8.2 or PHP 8.3 to 8.4 upgrade.
Rather leave old PHP code behind? See our PHP to Laravel, PHP to Node.js and PHP to Python migrations, or move an online store with PHP to Shopify.
Frequently asked questions
Researchers at two US cybersecurity groups, Calif and Wiz, discovered the vulnerabilities.
Alphabet-owned Wiz estimated that the compromised programming language powered about 70 percent of all websites in the world.
OpenAI stated that to their knowledge, frontier AI found these vulnerabilities before attackers did.
The NSA recommended that organizations take the system offline until it can be fully mitigated.
PHP has a wide presence because WordPress, the most widely used website-building platform, is written primarily in PHP and relies on it to function.
Based on reporting by Ars Technica. Read the original article
