The United States National Security Agency (NSA) issued an unusual public warning on Wednesday about two critical vulnerabilities in PHP. The NSA advised taking websites offline when operators could not update PHP immediately. The NSA also urged every organization using PHP to prepare for an update addressing both vulnerabilities. PHP is used by more than 70% of websites.
Authorities in Europe, Asia and elsewhere temporarily disabled some government websites to guard against the newly discovered vulnerabilities. Germany's digital ministry said the ministry had taken some websites offline as a precaution. France's interior ministry disabled official websites serving local administrative offices. Authorities in Belgium, the Netherlands, Finland and the Czech Republic said they had shut down websites to install a patch addressing the PHP vulnerability. Japan's Prime Minister Sanae Takaichi also issued a warning about the PHP risk on social media.
Cybersecurity experts identified the two vulnerabilities, named PHP2Shell, with assistance from artificial intelligence models. Researchers from security company Calif worked with OpenAI and reported the first vulnerability on August 11. Wiz, a security company owned by Alphabet, reported the second vulnerability on August 24.
Wiz described the vulnerabilities as among the most severe ever identified in PHP and arguably in software overall. Wiz said the underlying defects had existed for decades. Wiz said demonstrating that attackers could exploit the defects required a sequence of steps approaching the practical limits of human researchers. AI tools let researchers test more attacks while searching for software vulnerabilities than human programmers could test alone.
The nonprofit PHP Foundation maintains the programming language. The PHP Foundation said on Wednesday that the vulnerabilities were among the most severe the foundation had encountered. The PHP Foundation urged website administrators to update code immediately. Both vulnerabilities involve unauthorized access to memory that attackers can exploit to execute malicious code. The vulnerabilities allow attackers to execute commands remotely over the internet on servers running old PHP code without a password or legitimate account.
The PHP Foundation warned that AI would make vulnerabilities of this kind easier to discover. The PHP Foundation urged technology companies to organize a joint response to prevent major interruptions to online services. The PHP Foundation said tools now discover software defects faster for both attackers and defenders, and the volume of vulnerability reports will continue increasing.
Global Authorities Warn of Critical PHP Vulnerabilities, Take Websites Offline
FLASH AIShare
Summary
Global cybersecurity agencies have issued urgent warnings about two severe smart contract vulnerabilities in PHP, the language powering over 70% of websites. The U.S. NSA and governments in Germany, France, and others have taken sites offline temporarily. The flaws, named PHP2Shell, enable remote code execution on unpatched servers. AI tools played a key role in identifying these issues, with the PHP Foundation urging immediate updates. Experts warn that Proof of Work (PoW) systems are not immune to similar AI-driven discovery methods. Developers are scrambling to apply patches before attackers exploit the weaknesses.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.