TLDR
- The PHP2Shell flaw was disclosed on Wednesday and affects PHP versions released over the last decade.
- PHP powers about 70% of the worldās websites, according to Wiz.
- Cloudflare says it has seen millions of exploit attempts since the announcement.
- The NSA and UK cyber agency told organizations to patch fast or take systems offline.
- CISA says it has not identified any successful attacks linked to the flaw.
A flaw in the PHP programming language has set off a global security response. Governments and companies are racing to patch their systems, and some have taken websites offline.
The flaw is called PHP2Shell. It was disclosed on Wednesday and affects versions of PHP released over the last decade.
PHP is a back-end language that runs on web servers. Wiz says it powers about 70% of the worldās websites, including Wikipedia and WordPress.
What researchers found
Researchers at Wiz and Calif found two vulnerabilities inside PHP itself. They used advanced AI tools that can scan code faster than people or older systems.
Wiz said hackers could take control of affected web servers and steal data under the right conditions. The company called the flaws the most severe ever detected by AI.
Ryan Austin, a Calif researcher, said it was the most serious vulnerability he has found. OpenAI, whose technology was used in the discovery, called it one of the most impactful security issues in recent memory.
Salil Kanhere of UNSW Sydney said the bugs were not new. He said what changed was the ability to find them.
Details leaked online this week. That forced the PHP Foundation to rush out its announcement and release patches on Wednesday.
Cloudflare chief executive Matthew Prince said the company saw thousands of exploit attempts in the 10 hours before the announcement. He said the number rose to tens of thousands within 45 minutes and to millions since.
Amazon said it was targeted in multiple attempts days before the disclosure. It said its websites were operating as normal.
How governments and companies responded
The US National Security Agency told organizations to take systems offline if they cannot patch right away. The UKās National Cyber Security Centre gave similar advice and asked organizations to check for backdoors.
Websites went dark in several countries. The Finnish government, Edinburgh council, the BBC and the Dutch cyber-security agency took down sites or pages, while Wikimedia pulled some systems.
Japanese Prime Minister Sanae Takaichi asked people to check whether their public websites run on PHP. She said suspending a site can reduce risk if a patch cannot be applied quickly.
Experts say the fix is hard for large companies. Many firms do not know where PHP runs in their systems, and John Gallagher of Viakoo said the window of vulnerability could last several months.
Downtime also has a price. Some estimates put unplanned outages at large companies at up to $15,000 a minute.
Jason Soroko of Sectigo said updating WordPress or its plugins does not fix the flaw, because the problem sits in PHP itself. He said companies should also replace server passwords and certificates after patching.
Most everyday users do not need to act. Kanhere advised people to watch for password change requests from affected services and to be careful with phishing messages that use the news.
The US Cybersecurity and Infrastructure Security Agency has urged organizations to patch internet-facing apps first. It said it has not identified any successful attacks linked to the flaw.
Kanhere said more attempts are likely in the coming weeks now that the technical details are public.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
