Critical Security Flaws Prompt Emergency Action

Several websites worldwide, including services operated by Japan’s Finance Ministry, US human resources platform BambooHR, the Port of Rotterdam and the Wikimedia Foundation, went offline on October 21 as a precaution against two critical vulnerabilities in PHP. Collectively known as PHP2Shell, the flaws could allow attackers to execute malicious code remotely or access sensitive information stored on affected servers.

PHP, or Hypertext Preprocessor, is a free, open-source programming language used by around 70% of websites whose server-side language is identifiable. It powers websites handling logins, job applications and online transactions. The popular content management system WordPress, which runs more than 40% of websites worldwide, also relies on PHP.

The vulnerabilities involve errors in memory management. One flaw may cause PHP to treat incomplete information as valid after a process is interrupted due to memory problems. The other may allow outdated information from an earlier web request to be mistakenly reused while processing a new request. Under certain conditions, attackers could exploit these weaknesses without logging in, potentially putting personal information, uploaded documents and login credentials at risk.

Security Updates Issued as AI Speeds Up Discovery

The PHP developers released security updates on October 21, a day earlier than planned, after details of the vulnerabilities began circulating online. Cybersecurity agencies, including India’s CERT-In and the European Union’s CERT-EU, urged organisations to install the fixes immediately. Organisations unable to update vulnerable systems were advised to temporarily take them offline.

Researchers at cybersecurity firms Wiz and Calif identified the vulnerabilities using advanced artificial intelligence tools in August. OpenAI said one flaw was discovered by Calif using an OpenAI model. Researchers worked with PHP developers to prepare fixes, reportedly involving changes to nearly 200 files and more than 10,000 lines of code.

Experts warned that AI could help attackers develop working exploits faster, reducing the time available for organisations to respond. However, updating systems remains challenging because PHP may run on shared hosting platforms, older devices and third-party products.

The incident highlights the importance of timely security updates and identifying every system running vulnerable software.