PHP2Shell Vulnerability Affects 70% of Websites, AI Aids Discovery

Cybersecurity researchers used an advanced OpenAI AI model to discover a longstanding PHP vulnerability before hackers could exploit the flaw. Ethical hackers in California identified the bug, named PHP2Shell, with advanced AI models providing crucial assistance. The bug had been present for at least a decade.

PHP, short for "Personal Home Page," powers up to 70% of websites and web applications worldwide. Government agencies and social media platforms, including Facebook, use websites and applications built with PHP. Wall Street Journal reporter Robert McMillan, who first covered the security issue, said PHP is so widespread that some users do not realize they use PHP. McMillan warned that many websites may be unaware of the problem and could discover the danger through an attack.

McMillan said people had noticed unusual behavior but had been unable to turn a potentially crash-causing bug into an exploit allowing unauthorized software execution. McMillan said the researchers considered the investigation complicated and tedious, potentially requiring months of human effort. McMillan said AI could complete that prolonged, complex work much faster. The discovery highlights competition between cybersecurity researchers and hackers using AI to find weaknesses in organizations' technology systems.

Andrés Guerrero-Saade, SentinelOne's vice president of intelligence and security research, said AI accelerates vulnerability research while also strengthening attackers' ability to exploit flaws. Guerrero-Saade said the interval between discovering a vulnerability and releasing a fix is crucial. Guerrero-Saade also emphasized the race to apply available fixes before attackers exploit unpatched systems. AI has shortened that window by enabling cybercriminals to act much faster. Guerrero-Saade said security researchers are trying to persuade organizations to apply fixes promptly.

The PHP Foundation, which includes developers responsible for helping secure PHP, said on Wednesday that the foundation had released fixes and instructions for updating systems. The foundation urged everyone running PHP to update immediately. The foundation said the announcement on php.net provides or references technical information about the vulnerabilities, attack methods and system-specific update instructions.

The FBI's cyber threat division acknowledged the vulnerabilities and said cybercriminals could remotely insert malware into PHP source code. The division warned that such interference could compromise sensitive information and networks. The FBI urged organizations unable to apply fixes immediately to take affected websites offline temporarily. Mediatech security head Voldemaras Kadys said two critical PHP flaws could let hackers take control of vulnerable website servers. Kadys said attackers could potentially steal customer information, alter website content, install malware or make websites entirely unavailable. Kadys said the possible impact could be enormous because most websites use PHP.

Consumers' personal information could be exposed if consumers hold accounts with insecure online stores or booking platforms. Kadys said visiting a PHP website does not necessarily compromise the visitor's device. Kadys said the danger instead concerns attackers exploiting websites that store users' personal information. Kadys said attackers could potentially extract stored email addresses, physical addresses, names and dates of birth from an online shop through the PHP vulnerability. A vulnerable website does not establish that a breach has happened or will happen. Kadys said users do not need to stop browsing or shopping online. However, Kadys urged greater caution toward suspicious messages because the information potentially stolen through the vulnerability, and the websites potentially affected, remain unknown.