Global Governments Scramble to Secure Websites After Critical PHP Vulnerabilities Discovered, AI Aided in Finding Flaws

Governments across Europe, Asia, and other continents have taken the precautionary step of temporarily disabling some of their websites to safeguard against newly identified security vulnerabilities within the PHP programming language. This language is fundamental to the operation of a vast majority of internet sites.

On Wednesday, the United States National Security Agency (NSA) issued a rare public advisory regarding these PHP vulnerabilities, recommending that websites be taken offline if immediate updates were not feasible. "Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities," the NSA stated in a social media post.

In Germany, the Federal Ministry for Digital Transformation and Government Modernisation confirmed it had temporarily deactivated some websites as a protective measure. Similarly, France’s Ministry of the Interior took down the official websites for its local administrative offices. Authorities in Belgium, the Netherlands, Finland, and the Czech Republic also reported shutting down websites to implement a security patch that would close the identified PHP loophole.

Even Japanese Prime Minister Sanae Takaichi took to social media to alert the public about the PHP-related risks.

The pair of vulnerabilities, identified as PHP2Shell, were discovered by cybersecurity experts with the assistance of artificial intelligence (AI) models. Researchers at the security firm Calif, in collaboration with OpenAI, first reported one flaw on August 11. Wiz, a security firm owned by Alphabet, reported the second vulnerability on August 24.

Wiz described the findings as ranking "among the most severe vulnerabilities discovered in PHP, and arguably in software history." The firm noted that while the underlying flaws had existed for decades, exploiting them required a complex series of steps that were previously at the limit of what human researchers could practically achieve. AI tools have enabled researchers to identify software vulnerabilities by simulating a greater number of attacks than human programmers can manage alone.

The PHP programming language is maintained by volunteers, and the nonprofit PHP Foundation acknowledged on Wednesday that these flaws were among the most critical they had encountered. The foundation strongly advised anyone managing a website to update their code without delay.

Both vulnerabilities involve unauthorized access to certain memory segments, which can then be exploited to execute malicious code. These loopholes allow an attacker to remotely execute commands on a server running older PHP code over the internet, bypassing the need for passwords or legitimate account credentials.

The PHP Foundation also issued a warning that AI could simplify the process of discovering such security weaknesses. The organization called for a coordinated response from technology companies to prevent significant disruptions to online services. "Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing," the foundation stated.