Critical PHP vulnerabilities trigger global scramble as governments pull websites offline

The PHP2Shell vulnerabilities have triggered a global scramble to patch a programming language that underpins roughly 70% of websites, as governments and companies pulled sites offline before fixes were ready. The PHP Foundation released patches Wednesday.

The two vulnerabilities, each scoring 9.2 out of 10 on the industry severity scale, allow remote code execution on PHP servers, enabling attackers to steal data and read sensitive information from server memory, including passwords and other credentials. The flaws stem from how PHP handles fatal errors, such as running out of memory. They affect PHP 5.4 and later versions, more than a decade of releases, and had been lurking in the codebase for more than a decade.

The vulnerabilities were found independently by cybersecurity companies Calif and Wiz. Calif worked with OpenAI in the discovery, while Wiz is owned by Google. Both teams used AI tools to find the vulnerabilities. Calif reported the first vulnerability on August 11, and Wiz reported the second on August 24. The two firms coordinated with each other, the PHP team, and OpenAI before making the vulnerabilities public. Wiz said in a blog post: ‘The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.’

Details of the vulnerabilities leaked online Tuesday before fixes were available, after Calif accidentally posted a proof-of-concept video demonstrating an exploit chain, which was later taken down. Code claiming to exploit PHP2Shell was posted to public repository GitHub before the patch release. The PHP Foundation, which had intended to release patches on Thursday, released them 24 hours early, at 10 a.m. ET on Wednesday. PHP users were urged to update immediately.

Governments pull sites offline

The Netherlands’ cybersecurity agency took its own website offline as a precaution. In the Netherlands, the Port of Rotterdam, Overheid.nl, the KNVB, websites for the country’s five largest political parties, and several hospital websites were also taken offline. Finland took public network services offline. France’s Ministry of the Interior placed all of its websites into preventive maintenance. Belgium’s Federal Public Service Foreign Affairs temporarily took its websites offline. In the UK, 32 government services were taken offline, according to cybersecurity minister Liz Lloyd. Downing Street said no public-facing critical services had been affected. A number of Scotland’s public organisations, including councils and health boards, took their websites offline, as did Edinburgh council. Wikimedia took down a number of its systems. The Internet Archive briefly went offline. The BBC took some of its sites offline, including the Traitors website.

The NSA warned organizations to patch immediately or take systems offline. Japanese Prime Minister Sanae Takaichi urged businesses to patch or shut down their sites. South Korea raised its private-sector cybersecurity alert level and activated emergency response measures, issuing guidance to about 28,000 companies with registered chief information security officers and 5,900 members of a government information-sharing network. China’s industry ministry urged organizations to inspect systems and upgrade to the latest secure version of PHP. The UK’s National Cyber Security Centre issued advice to check for backdoors. EU, Singapore, and Australia cybersecurity authorities issued similar alerts.

Exploit attempts surge

Amazon security chief CJ Moses said his team detected an exploit attempt on October 17, four days before public disclosure, when the vulnerabilities were still under embargo. Moses said it was unclear how the attacker learned of the flaws. Amazon said its websites were operating as normal despite being targeted. Cloudflare CEO Matthew Prince reported thousands of exploit attempts in the 10 hours before public announcement, jumping to tens of thousands in the 45 minutes after, hundreds of thousands within two hours, and millions thereafter.

A flaw missed once before

Two years ago, Mihail Kirov, then at Quarkslab, was part of a team that found a vulnerability with the same root cause as PHP2Shell. The PHP Foundation was alerted but no fix was rolled out. The PHP Foundation acknowledged in a blog post that the delay was a ‘structural failure, caused by both the security team’s decision process and its lack of resources.’ Wiz described the flaws as among the most severe ever detected by AI. OpenAI called it ‘one of the most impactful security issues in recent memory.’

Elizabeth Barron, executive director of The PHP Foundation, said there was no evidence of working exploits, only ‘incomplete, misguided, and non-working generated ones.’ Matt Suiche of Tolmo said his team coded a working exploit in less than a day using AI. Amazon Threat Intelligence said PHP2Shell was ‘now being broadly exploited in the wild.’ Ciaran Martin, former chief executive of the UK’s NCSC, called it ‘the most serious vulnerability discovered for five years.’ Ryan Austin, a researcher at Calif, said: ‘At the moment it doesn’t look like exploitation has taken off or been widespread.’