Critical PHP Flaws Trigger Global Website Outages and Emergency Patching

Government websites across Europe and beyond were taken offline following reports of critical vulnerabilities in PHP, prompting site operators to move quickly to protect their systems.

The PHP development team released urgent security fixes on Wednesday and urged all users to “update immediately.”

PHP powers the servers that build websites before delivering pages to visitors’ browsers. Although most people never interact with the language directly, it supports everything from blogs and online stores to government portals.

The vulnerabilities had remained hidden in the software for years before being uncovered with the help of artificial intelligence. Details of the flaws leaked online on Tuesday, before patches were available, forcing the PHP team to release the fixes ahead of schedule.

Security experts warned that a wave of intrusions could begin as attackers tried to exploit the flaws before organizations had a chance to apply the updates.

What is the bug?

Andrew Cullen, a lecturer in AI and cybersecurity at the University of Melbourne, said the flaw was found in foundational software used by a large number of connected devices around the world.

The vulnerability allows an attacker to execute code on a website. An attacker could therefore alter a site or force it to disclose personal information stored in a database, Cullen told Al Jazeera.

Both vulnerabilities relate to the way PHP handles fatal errors, such as when a process runs out of memory. Because the issue is built into PHP itself, even a basic website running an affected version could be vulnerable. Attackers might also be able to retrieve passwords and other credentials from a server’s memory, according to cloud security company Wiz. Both flaws received a severity score of 9.2 out of 10 on the industry’s standard scale, placing them in the “critical” category.

The two vulnerabilities, collectively nicknamed PHP2Shell, were independently identified by cybersecurity companies using AI. Calif, working with OpenAI, reported the first flaw on August 11. Google-owned Wiz reported the second on August 24.

According to Wiz, the vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily difficult for human hackers to discover and exploit.

Calif and Wiz said they coordinated with each other, the PHP team and OpenAI before publicly disclosing the vulnerabilities.

Amazon security chief CJ Moses, however, said his team detected an attempted exploitation on October 17, four days before the public announcement.

Moses said it was unclear how the attacker learned of the flaws while Calif’s and Wiz’s reports were still under embargo. Researchers generally keep vulnerability details confidential until patches are ready so that attackers cannot exploit them during the disclosure process.

Who can potentially be affected?

PHP, which was developed in the early 1990s and originally stood for Personal Home Page, underpins large parts of the public-facing web. It is also used in WordPress, Drupal, Joomla and Magento websites, meaning a critical vulnerability can have extensive downstream consequences.

Calif, Wiz and web infrastructure company Cloudflare said the flaws affect PHP 5.4 and later versions, spanning more than a decade of releases.

Cullen described the vulnerability as “really unprecedented,” noting that PHP powers more than 70 percent of websites globally. Sites that apply the updates are protected.

“There is a real risk to the kind of shared digital infrastructure that we all rely on,” Cullen told Al Jazeera. “There is concern in the cybersecurity community about what the blast radius for this will be, even though the developers of PHP have been very quick to try and develop patches for it.”

Cullen added that as AI becomes more capable in cybersecurity, it is also making it easier to operate as a hacker. “This means that we are developing systems … that are making the internet safer by helping to fix bugs, but we’re also making it riskier by discovering bugs and creating bugs they’ll be able to hack,” he said.

What has the impact been so far?

In the Netherlands, the Dutch cybersecurity agency took its website offline as a precaution following the vulnerability reports. Several other organizations followed suit, including the Port of Rotterdam, the government portal Overheid.nl, the national football association KNVB, the websites of the country’s five largest political parties and several hospitals.

Dutch Prime Minister Rob Jetten said he was closely monitoring the situation.

Disruptions were more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline “as a precautionary measure.”

France’s Ministry of the Interior said it had placed all of its websites into preventive maintenance.

Belgium’s Federal Public Service Foreign Affairs, Foreign Trade and Development Cooperation said it had temporarily taken its websites offline after reports of cyberattacks exploiting the PHP vulnerabilities. The country’s cybersecurity center, however, said it had not recorded any attacks on Belgian websites.

South Korea’s government raised its private-sector cybersecurity alert level and activated emergency response measures. It issued security guidance to approximately 28,000 companies with registered chief information security officers, 5,900 members of a government information-sharing network, critical-infrastructure operators, web-hosting firms and data centers.

Wikipedia’s operator also said it had taken an unspecified number of systems offline until they could be safely patched. The Internet Archive, the online library, said it had briefly gone offline to address the issue.

Source link