Critical PHP vulnerability triggers precautionary website takedowns worldwide

A critical vulnerability in PHP, the programming language powering roughly 70% of websites, has prompted precautionary takedowns of sites worldwide after researchers flagged it as among the most significant security flaws ever found in the language.

Details of the flaw leaked on social media Tuesday, forcing the PHP Foundation to rush out its announcement. The vulnerability became public Tuesday, and a patch was issued Wednesday. The US National Security Agency advised organizations using PHP to either immediately update or take their systems offline. The UK’s National Cyber Security Centre issued similar advice, telling organizations to consider taking systems offline where immediate remediation was not feasible.

Governments and institutions pull sites offline

Governments in Belgium, the Netherlands, Finland, France, and Germany took down sites temporarily as they scrambled to patch the flaw. The Wikimedia Foundation took down several systems as a precautionary measure until they could be safely patched. Edinburgh council’s website went offline, as did the websites of Bristol and Oxford councils. Finland temporarily shut down the government’s public web services. In the Netherlands, the national cybersecurity centre took its own website offline, the lower house of the Dutch parliament became inaccessible, the national digital identity service went offline, and the National Institute for Public Health and the Environment took down its website. In France, local government websites including that of the Paris police prefecture went offline on Wednesday.

Several BBC programme websites including Doctor Who and The Traitors became inaccessible. The BBC has not confirmed a link to PHP. DeviantArt said it was temporarily down for maintenance without specifying the reason.

Agencies worldwide urge immediate action

The EU and Australia’s cyber-security agencies urged PHP users to apply fixes. Japan’s Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP. Japan’s national cyber-security office and EU cyber-security officials issued a similar warning. The White House said federal agencies were working with leading AI labs to speed up a fix.

AI tools and a leaked secret

The vulnerabilities were discovered by cybersecurity researchers at the firms Calif and Wiz. Calif, along with the PHP Foundation, were part of a program started by OpenAI called Patch the Planet, which gave participants access to OpenAI’s advanced AI tools to find and fix flaws in web development languages. OpenAI said an internal researcher at the company had also discovered the issue around the same time as the other firms. The flaws had gone undetected for more than a decade and were discovered by August after a few weeks of using advanced AI tools. Wiz said in a blog post that frontier models were critical to making the process practical, enabling development and adaptation of working exploits across multiple applications in hours. The researcher who found the weakness, however, said they did not use models that were not available to the general public. The underlying vulnerabilities were decades old.

A long tail of exposure

The NSA said the vulnerability could provide a direct path to the server’s file system or database. CERT-EU said the risk scores indicate the potential for unauthenticated remote code execution. CERT-EU said the vulnerability could affect all versions of PHP dating back to PHP 5 onwards, which launched in 2004. The PHP Foundation issued the update only for the latest versions, with people using PHP 8.1 or older urged to upgrade. Huntress said PHP quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and software that does not advertise it runs PHP. Don Smith, from the Sophos Counter Threat Unit, said the use of PHP is pervasive, sitting beneath public websites, content management systems, hosting platforms, and third-party products, sometimes without being obvious to the organization using it. Cloudflare CTO Dane Knecht said he was seeing early attacks emerging and updating mitigations as new vectors show up. Prof Alan Woodward of Surrey University said: “The troubling part is there is going to be a long tail of websites who may not be maintained as well and they are going to remain vulnerable, which means we may see weeks and months of ongoing attacks. For the big juicy targets, I hope to goodness they are being patched quickly.”

Michał Woźniak, an internet infrastructure expert, said the bug might allow cryptocurrency miners to exploit vulnerable servers. He said large crime organisations and Russian state actors could use vulnerable sites as a launching pad for DDoS and other cyber-attacks.