The official PHP website and other organizations and agencies issued advisories Wednesday calling for immediate fixes to two critical vulnerabilities. The advisories urged users unable to update immediately to take affected websites offline. The FBI's cyber division also warned about the vulnerabilities on Wednesday. Experts described the flaws as among the most significant vulnerabilities in recent memory.
PHP is a general-purpose scripting language designed primarily for web development. PHP powers about 70% of websites worldwide, making the potential exposure extensive. PHP is free and open-source, contributing to the language's widespread adoption. PHP underpins WordPress and Drupal, content management systems that governments commonly use for websites. PHP also underpins MediaWiki, the software behind Wikipedia.
The PHP Foundation, which promotes transparency and accountability around the language, said attackers could exploit the flaws to access PHP-based sites without authentication. James Sullivan, director of cyber and tech at London's Royal United Services Institute, said attackers could remotely control a web server without a password. Sullivan said attackers could then steal or change data, or use the compromised system to launch further attacks.
Several websites went offline while operators addressed the problem, following the security advisories issued this week. Government services and websites in the United Kingdom, Finland and Japan have experienced disruptions. Some websites may remain offline because different software requires different patches, and some organizations may still be waiting for those patches. Organizations also need to test the patches to ensure the fixes work.
The PHP Foundation said the vulnerabilities had been known since at least 2024. The foundation said a security team developed competing solutions, but each approach had drawbacks. The foundation said work on a fix stalled because attackers appeared to lack a practical, concrete method of exploiting the vulnerabilities. The foundation accepted responsibility for the delay and attributed the failure to the security team's decision-making process and insufficient resources. Some experts said the vulnerabilities might have been discovered before 2024.
AI agents helped identify the vulnerabilities. OpenAI said in a blog post that OpenAI had led researchers, security providers and other participants in addressing PHP vulnerabilities over the past two months. Researchers at cloud security platform Wiz said the researchers independently identified the vulnerabilities using AI.
Accessible AI gives organizations of different sizes more advanced tools for preventing and responding to security threats. However, AI also gives attackers more advanced tools for exploiting digital weaknesses on a large scale. Sullivan said the competing developments can be concerning, but Sullivan emphasized the benefits. Sullivan described the episode as a useful example of AI finding critical vulnerabilities and the community working together to fix those vulnerabilities.
PHP Security Flaws Impact 70% of Websites, AI Helps Identify Vulnerabilities
FLASH AIShare
Summary
PHP security flaws affecting 70% of websites have drawn CFT attention as high-profile fixes are urged. FLASH AI, the PHP Foundation, and partners issued advisories for two critical vulnerabilities that could allow unauthenticated access. Governments in the UK, Finland, and Japan reported disruptions. AI tools from OpenAI and Wiz helped uncover the flaws. Liquidity and crypto markets may also be impacted as website stability is key to digital transactions.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.