AI Uncovers Decade-Old Flaws in PHP, Triggering Global Website Shutdowns
Critical vulnerabilities in core web language prompt emergency fixes and warnings from cybersecurity agencies worldwide.
Sarah Connor
Serious flaws in the PHP programming language, undetected for over a decade, have been exposed.
Governments and cybersecurity agencies worldwide issued urgent alerts, demanding website operators apply an emergency fix or take platforms offline. The National Cyber Security Centre (NCSC) specifically urged organizations to update to a new, fixed version of PHP or to take websites offline if immediate upgrades were not possible.
The Finnish government's website, Oxford City Council, Edinburgh City Council, and the Office for Budget Responsibility were among those forced offline. Some government online services may be temporarily unavailable as security measures are implemented, though any impact is expected to be minimal.
The cyber division of the US National Security Agency warned that weaknesses in the software could provide a direct path to a server's file system or database. Paul Spain claims the flaw could affect "millions and millions of websites," with Wiz claiming roughly 70% of the internet is affected.
In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it.
Matthew Prince, from Cloudflare, detailed the rapid escalation of exploitation attempts. "In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it," Prince stated, adding that this jumped to "tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now."
Amazon was targeted in multiple attempts before an embargo on the warning was lifted. CJ Moses stated that the use of an anonymous IP address suggests the activity was conducted by a "threat actor," with varied payloads and anonymization infrastructure indicating multiple actors were involved.
It remains unclear how actors knew about the vulnerabilities, Amazon claims. Details of the flaw leaked on social media on Tuesday, complicating the response.
work is already under way across Government to actively identify and patch any potential exposure.
A Government spokesperson confirmed that work "is already under way across Government to actively identify and patch any potential exposure." The spokesperson encouraged all organizations, private and public, to follow NCSC guidance to understand their exposure and safeguard systems. Salil Kanhere claims more attempts to exploit these flaws are likely in the coming weeks as technical details become public.