AI researchers uncovered two critical vulnerabilities in PHP, a programming language that powers 70% of the world's websites, sparking an emergency global response on Wednesday.
Security researchers at firms Wiz and Calif discovered the flaws, termed "php2shell," which exist within PHP itself across versions released over the past decade. Under certain conditions, attackers could exploit these vulnerabilities to seize control of web servers and steal sensitive data. Ryan Austin, a Calif researcher involved in the discovery, told the BBC it was "the most serious vulnerability I've ever found." Wiz described it as the "most severe" flaw ever detected by AI, while OpenAI, whose technology helped uncover the vulnerabilities, called it "one of the most impactful security issues in recent memory."
PHP, which stands for PHP: Hypertext Preprocessor, is an open-source backend programming language developed in the early 1990s. It powers platforms including Wikipedia, WordPress, and numerous e-commerce sites. The language remained undetected with these serious flaws for over a decade.
The PHP Foundation released emergency patches on Wednesday and urged all users to update immediately. Governments and security agencies worldwide issued urgent directives. The US National Security Agency instructed organisations unable to patch immediately to take systems offline, warning the flaw could provide a "direct path" to exploit databases. The UK's National Cyber Security Centre advised organisations to check for backdoors installed by attackers. Similar alerts came from cyber-security agencies in the EU, Singapore, Australia and Japan.
Multiple major websites went offline as precautions. Wikipedia's parent organisation, Wikimedia, shut down systems. The Finnish government, Edinburgh council, the BBC, and the Netherlands' cyber-security agency pulled their websites. Scotland's public bodies, including councils and health boards, also went offline.
Amazon reported being targeted in multiple exploit attempts days before public disclosure, though its websites continued operating normally. Cloudflare's chief Matthew Prince said the company observed thousands of attempts to exploit the vulnerability within 10 hours before public announcement, rising to tens of thousands afterward.
Security experts warned that smaller organisations with limited security resources face heightened risk. Paul Spain, chief executive of Gorilla Cyber Security, estimated the flaw could affect "millions and millions" of websites. Cyber-security researcher Jill Slay from the University of Adelaide cautioned it would be "disastrous" if attackers or hostile countries weaponised the vulnerability.