Two Severe Flaws in PHP: Rare NSA Warning as Governments Take Websites Offline
Warnings have been issued worldwide over two newly discovered security flaws in PHP, the programming language that powers a vast number of websites on the internet. The pair of vulnerabilities, pinpointed with the help of artificial intelligence, affect PHP, which is used by about 70 percent of websites.
On Wednesday, the vulnerabilities prompted a rare public warning from the United States National Security Agency, the NSA, which advised taking websites offline if they could not be updated immediately. In a social media post, the NSA said all organisations using PHP for their systems should be prepared for an update addressing two critical vulnerabilities, effective immediately.
Authorities in Europe, Asia and other continents have temporarily taken some government websites offline. In Germany, the Federal Ministry for Digital Transformation and Government Modernisation said it took some websites offline as a preventative measure. France's Ministry of the Interior deactivated the official websites for local administrative offices.
Authorities in Belgium, the Netherlands, Finland and the Czech Republic also said they had shut down websites to apply a security patch to close the PHP loophole. Even Japanese Prime Minister Sanae Takaichi posted on social media to warn about the PHP risk.
Cybersecurity experts discovered the pair of vulnerabilities, dubbed PHP2Shell, with the help of artificial intelligence models. Researchers at security firm Calif, working with OpenAI, reported the first flaw on August 11. Wiz, a security firm owned by tech giant Alphabet, reported the second vulnerability on August 24.
Wiz said the findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The firm said the underlying flaws had been present for decades, but proving they were exploitable required a chain of steps at the edge of what human researchers could practically achieve.
AI tools let researchers find vulnerabilities in software by testing more attacks than human programmers can alone. Volunteers maintain the PHP programming language, and the nonprofit PHP Foundation said on Wednesday that the flaws were among the most severe it had encountered.
The group urged anyone administering a website to update their code immediately. Both flaws rely on accessing parts of memory without proper authorisation and exploiting that access to run malicious code.
The two loopholes mean an attacker can remotely run commands on a server running old PHP code over the internet, without needing a password or legitimate account access.
The PHP Foundation also warned that AI would make such security weaknesses easier to find. It called on tech companies to mount a coordinated response to avoid major disruptions to online services.
In a statement, the foundation said tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing.
Following the warning, operators of government and private websites in different countries now have to focus on quickly applying patches and checking updates, so that these long-hidden flaws cannot be exploited for a major attack.
