PHP flaw shuts government sites as NSA urges patch

Governments across Europe and beyond took websites offline this week after researchers disclosed two critical vulnerabilities in PHP, the programming language behind most of the web, The Guardian reported. The flaws became public on Tuesday, and the PHP Foundation issued a patch on Wednesday. PHP underpins almost 70% of websites, according to The Guardian, including WordPress and Wikipedia.

The US National Security Agency advised any organization running PHP to take systems offline if they could not patch immediately, warning the bug could offer “a direct path to the server’s file system or database.” The UK’s National Cyber Security Centre gave similar guidance and urged checks for backdoors left by attackers, The Guardian reported.

Also read: Kraken parent Payward wins full Dubai VARA license for UAE launch

Key facts

• The two flaws, dubbed PHP2Shell by Aljazeera, were found with the help of AI models; security firm Calif reported the first on August 11 and Alphabet-owned Wiz reported the second on August 24.
• Wiz said the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.”
• Sites taken offline included French local government pages and the Paris police prefecture, the Dutch national digital identity service, and UK council sites for Edinburgh, Bristol and Oxford.
• Amazon security chief CJ Moses said his team detected an attempt to exploit the flaws against a decoy “honeypot” system on October 17, four days before public disclosure.
• The White House said it was made aware of the flaw on Friday.

Race to exploit

Experts warned that a public fix and AI-assisted reverse engineering could fuel a wave of intrusions. Costin Raiu, co-founder of cybersecurity firm TLP:Black, described a “race to exploit” and said the next step was the “mass compromise of every vulnerable web server on the internet,” according to The Guardian.

Prof Alan Woodward of Surrey University said the quick patch was welcome but that a long tail of poorly maintained sites would stay exposed, raising the prospect of weeks or months of attacks. The Wikimedia Foundation said it took several systems down on Wednesday as a precaution until they could be patched.

Also read: Citi and Coinbase Launch Stablecoin-to-Dollar Conversion for US Institutions

There is disagreement over who deserves credit for the discovery. OpenAI said it led a coalition of researchers that found the flaw and said “frontier AI” was key, while the researcher who found the weakness said public models were used, The Guardian reported. Aljazeera noted the flaws sat hidden for decades and that proving exploitability required steps “at the edge of what human researchers could practically achieve.”

Why it matters

PHP’s reach means a single bug class can touch commercial sites, government portals and messaging tools at once. The episode also shows how AI is compressing the time between discovery and exploitation, and it lands on an industry with a long habit of deploying software and leaving updates aside, as infrastructure expert Michał Woźniak told The Guardian. For crypto operators, Woźniak warned that vulnerable servers could be hijacked for cryptocurrency mining at the owners’ expense, or used as launch pads for distributed denial-of-service attacks.

Japan’s Prime Minister Sanae Takaichi posted on social media to warn about the PHP risk, and Germany’s digital ministry said it took some sites offline as a preventative measure, according to Aljazeera.

What to watch

Attention now turns to how quickly administrators apply the PHP Foundation’s patch and whether the October 17 honeypot attempt signals wider scanning. The foundation warned that AI makes such bugs easier to find and called for a coordinated industry response.

Written by

Emily Torres

Emily Torres covers cryptocurrency and decentralized finance for StockPil, tracking blockchain markets and regulatory developments.

Sources: The Guardian, Aljazeera