Two decade-old PHP vulnerabilities trigger global website shutdowns

Websites have been taken offline worldwide. Two vulnerabilities in the PHP programming language, collectively known as PHP2Shell, triggered the global cybersecurity response as governments and businesses raced to apply emergency patches before attackers could exploit the flaws.

The vulnerabilities allow attackers to remotely execute malicious code on affected servers, potentially exposing sensitive data. The NSA warned the flaws could provide a direct path to the server’s file system or database, and agencies across four continents urged users to patch or take systems offline. An estimated 70% of websites use PHP. The two vulnerabilities went undetected for at least a decade before AI-assisted research brought them to light.

Governments take systems offline

The Finnish government shut down its public web services. The Dutch national cybersecurity centre went offline as a precaution. Edinburgh and Oxford council websites went offline on Wednesday, and the Wikimedia Foundation took down several systems as a precautionary measure until they could be patched. The NSA urged organizations using PHP to prepare security updates and to take affected systems offline if immediate updates were not possible, warning that the vulnerabilities are flaws in PHP itself, not in the hosted application or its configuration. The UK’s National Cyber Security Centre, EU cybersecurity authorities, and Australia issued alerts urging PHP users to apply fixes, with the NCSC advising organizations to check for backdoors installed by an attacker. The FBI warned that malicious actors could exploit the vulnerabilities to execute code remotely, putting sensitive data and networks at risk. Cybersecurity authorities in Singapore and Canada also issued alerts.

Belgian, Dutch, Finnish, French, and German government sites were among those taken down temporarily as administrators worked to apply patches. In France, local government websites including that of the Paris police prefecture went offline. In the Netherlands, the national digital identity service and the website of the house of representatives went offline. The UK’s Office for Budget Responsibility took its website offline following guidance. The Australian Signals Directorate was temporarily affected by the outage, with the national cyber defence agency noting other government websites may have been similarly affected.

AI and the race to find the flaws

OpenAI said it spent two months leading a coalition of researchers, software maintainers, and security providers to coordinate fixes ahead of public disclosure. The company described the flaws as among the most impactful security issues in recent memory. Google’s cybersecurity unit Wiz used AI models, including Gemini, to help find and investigate the vulnerabilities, with Gemini contributing to efforts to assess the flaws, test potential attacks, and verify security patches. Calif found them first. The cybersecurity company said it identified the flaws with the help of a large language model on 1 August. A researcher named Ryan A discovered the issue in mid-August alongside OpenAI’s Patch the Planet program. The PHP Foundation said it worked with Anthropic’s frontier model to scan its code. The role of frontier AI is disputed. The researcher who found the weakness said they used models available to the public, not frontier AI as OpenAI claimed.

Exploitation before the embargo lifted

Amazon detected the first exploitation attempt against one of its honeypot systems on 17 October, four days before public disclosure, when an anonymous internet address attempted to target weaknesses in the decoy system. Details of the flaws leaked on social media on Tuesday, prompting earlier disclosure. The embargo had been set for 22 October. Amazon said it was unclear how the actor learned of the flaws while they were under embargo. On 21 October, Amazon identified subsequent attacks with varying payloads. “The actual payloads and choices in anonymisation infrastructure varied, suggesting these were multiple actors,” said CJ Moses, Amazon’s security chief. The White House said it was made aware of the flaw on Friday.

A long tail of vulnerable sites

The PHP Foundation said the vulnerabilities sit in memory management and error handling, parts of PHP that nearly every request touches. Security firm Hadrian said it was seeing “exploitation happening at scale.” Don Smith, vice-president of threat intelligence at Sophos Counter Threat Unit, said the immediate challenge is finding and managing every instance where PHP is running. Sigi Goode, a professor at Australian National University, said the bigger concern is websites that are not down today. Cloudflare deployed protections through its web application firewall.

Prof Alan Woodward, a cybersecurity expert at Surrey University, said there will be a long tail of websites that remain vulnerable, with weeks and months of ongoing attacks. Michał Woźniak, an internet infrastructure expert, said large crime organisations and Russian state actors could use vulnerable sites as launching pads for DDoS and other cyber-attacks. Anna-Maria Arabia, CEO of the Australian Council on AI Strategy, said what used to take months to expose a vulnerability is now taking days.