PHP developers issued emergency fixes on Wednesday and urged every user to install the updates immediately. Details of the vulnerabilities appeared online on Tuesday before patches were available, prompting PHP to accelerate the release. Experts anticipated a surge in intrusions as attackers tried to exploit websites before operators installed updates.
The two vulnerabilities, collectively nicknamed PHP2Shell, were discovered independently by cybersecurity companies using artificial intelligence. Calif, collaborating with OpenAI, reported the first vulnerability on August 11. Google-owned Wiz reported the second vulnerability on August 24. Both vulnerabilities involve PHP's handling of fatal errors, including memory exhaustion. Each vulnerability received a score of 9.2 out of 10 on the industry's standard severity scale, classifying both as critical.
Calif, Wiz and Cloudflare said PHP 5.4 and subsequent versions are affected, covering more than a decade of releases. Wiz said the vulnerabilities had remained undiscovered in PHP's code for more than a decade and would have been exceptionally difficult for a human hacker to exploit. Wiz said even a basic website using an affected PHP version could be vulnerable because the flaws exist within PHP itself. Wiz said attackers could retrieve passwords and other credentials held in server memory.
Andrew Cullen, a University of Melbourne lecturer specialising in AI and cybersecurity, said the vulnerability enables attackers to execute code on a website. Cullen said attackers could alter website content or extract personal information stored in a database. Cullen said PHP powers more than 70 percent of websites worldwide, although websites with the updates installed are protected. PHP operates on website servers and prepares pages before browsers receive those pages. PHP is incorporated into WordPress, Drupal, Joomla and Magento websites and supports blogs, online shops and government portals.
Calif and Wiz said both companies coordinated with the PHP team, OpenAI and each other before publicly disclosing the vulnerabilities. However, Amazon security chief CJ Moses said Amazon's security team detected an attempt to exploit the vulnerabilities on October 17, four days before public disclosure. Moses said the way the attacker learned about the vulnerabilities remained unclear while the companies' findings were under embargo. Security researchers generally withhold vulnerability details until patches are available to prevent attackers from exploiting the flaws beforehand.
Cullen warned of a genuine threat to shared digital infrastructure and concern among cybersecurity specialists about the potential extent of the damage. Cullen said those concerns persisted despite PHP developers' rapid work on patches. Cullen said AI's improving cybersecurity capabilities also extend to hacking. Cullen argued that AI can improve internet safety by helping repair vulnerabilities while increasing risks by discovering and creating exploitable bugs.
The Netherlands' cybersecurity agency said the agency took its website offline as a precaution against the vulnerabilities. Other organisations that removed public-facing websites included the Port of Rotterdam, government portal Overheid.nl, national football association KNVB, the country's five largest political parties and several hospitals. Netherlands Prime Minister Rob Jetten said Jetten was monitoring developments closely.
Finland experienced more extensive disruption, with state IT services provider Valtori saying government public network services were taken offline as a precaution. France's Ministry of the Interior said the ministry placed every ministry website into preventive maintenance. Belgium's Federal Public Service Foreign Affairs, Foreign Trade and Development Cooperation said the service temporarily removed its websites following reports of cyberattacks exploiting the vulnerabilities. However, Belgium's cybersecurity centre said the centre had recorded no attacks against websites in Belgium.
South Korea's government increased the private-sector cybersecurity alert level and initiated emergency response measures. The government sent security guidance to about 28,000 companies with registered chief information security officers and 5,900 members of a government information-sharing network. The government also sent guidance to critical infrastructure operators, web-hosting companies and data centres.
Wikipedia's operator said the operator took an unspecified number of systems offline pending safe installation of patches. The Internet Archive said the online library briefly went offline to address the vulnerabilities.
PHP2Shell Vulnerabilities Threaten 70% of Websites, Prompt Global Cybersecurity Measures
FLASH AIShare
Summary
PHP2Shell vulnerabilities have exposed over 70% of websites, prompting urgent fixes from PHP developers. The flaws, rated 9.2/10, allow code execution and data theft. Security agencies in the Netherlands, Finland, Belgium, and South Korea have taken action, including site shutdowns. Smart contract vulnerabilities in blockchain systems highlight similar risks, as attackers could exploit weak code structures. Experts warn that Proof of Work (PoW) systems may be less affected but remain under close watch. Patches are critical to prevent large-scale intrusions before exploits spread.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.