Security advisories published Wednesday urged PHP users to repair two critical vulnerabilities or disable websites if immediate updates were impossible. The advisories appeared on PHP's official website and came from several other organizations and agencies. The organization behind PHP and the FBI's cyber division warned about significant vulnerabilities on Wednesday.
The PHP Foundation said attackers could exploit the vulnerabilities to access websites running PHP without authentication. James Sullivan, director of cyber and tech at London's Royal United Services Institute, said attackers could remotely control a web server without a password. Sullivan said attackers could then steal or change data, or use the compromised system to launch further attacks. Experts describe the vulnerabilities as among the most significant in recent memory.
PHP powers about 70% of websites worldwide, creating extensive potential exposure. PHP is a general-purpose scripting language designed primarily for web development. PHP's availability as free, open-source software contributes to the language's widespread use. PHP underpins WordPress and Drupal, content management systems that governments commonly use for websites. PHP also supports MediaWiki, the software behind Wikipedia.
Several websites went offline while operators addressed the vulnerabilities, following this week's security advisories. Government services and websites have experienced disruption in the United Kingdom, Finland and Japan. Some websites may remain offline because different software requires different patches, and some organizations may still be awaiting patches. Organizations also need to test the patches to confirm that the fixes work.
The PHP Foundation said the vulnerabilities had been known since at least 2024. The foundation said a security team developed competing solutions, but every approach had drawbacks. The foundation said work on a fix stalled because attackers appeared to lack a practical, concrete method of exploiting the vulnerabilities. The foundation accepted responsibility for the delay and attributed the failure to the security team's decision-making process and insufficient resources. Some experts say discovery of the vulnerabilities may date to before 2024.
AI agents helped identify the vulnerabilities. OpenAI said in a blog post that OpenAI had led a coalition of researchers, security providers and others addressing PHP vulnerabilities over the past two months. Researchers at cloud security platform Wiz said the researchers independently identified the vulnerabilities using AI.
Accessible AI gives organizations of different sizes more advanced tools to anticipate security threats and respond to attacks. However, AI also gives attackers more advanced tools to exploit digital vulnerabilities on a large scale. Sullivan said the competition between attackers and defenders can be concerning, but Sullivan emphasized the benefits. Sullivan said the episode demonstrated that AI can identify critical vulnerabilities and that the security community can work together to fix those vulnerabilities.
PHP Security Bugs Discovered via AI Pose Major Risk to 70% of Websites
FLASH AIShare
Summary
CFT initiatives face new challenges as PHP security bugs, discovered via AI, threaten 70% of websites. Advisories warn of critical flaws that could grant attackers full control without authentication. The PHP Foundation and FBI’s cyber division raised alarms, noting vulnerabilities impact major platforms like WordPress and MediaWiki. Some sites in the UK, Finland, and Japan faced outages after applying patches. The flaws, identified by OpenAI and Wiz researchers, had been known since 2024. Delays in fixes were attributed to resource constraints. Risk-on assets may face pressure as global web infrastructure remains under threat.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.