Internet at Risk: Critical PHP Flaw Threatens 70% of Websites, Prompting Urgent Global Updates

Critical vulnerabilities discovered in the widely-used PHP programming language have sent website operators worldwide scrambling to secure their systems, with government websites in Europe and elsewhere experiencing outages. Developers of PHP, a language powering a vast number of websites including those of major corporations and national governments, released urgent fixes on Wednesday, strongly encouraging all users to update immediately.

PHP operates on web servers, constructing web pages dynamically before they are delivered to users' browsers. While invisible to most users, it is fundamental to a wide range of online services, from personal blogs and e-commerce sites to government portals. These vulnerabilities, which had remained undetected for years, were brought to light with the assistance of artificial intelligence. Details of the flaws were leaked online on Tuesday, prior to the availability of fixes, compelling PHP to expedite their release. Cybersecurity experts are anticipating a surge in cyberattacks as malicious actors attempt to exploit the vulnerabilities before updates can be implemented.

What is the bug?

Andrew Cullen, a lecturer specializing in AI and cybersecurity at the University of Melbourne, explained that a significant number of the world's connected devices rely on a core piece of foundational software where the bug was identified. This vulnerability enables attackers to execute code on a website, potentially allowing them to alter the site's content or extract sensitive personal information stored in databases, Cullen informed Al Jazeera. Both identified flaws originate from how PHP handles critical errors, such as memory exhaustion. Because the issue resides within PHP itself, even the most basic websites running an affected version are susceptible. Attackers could potentially access passwords and other credentials from a server's memory, according to the cloud security firm Wiz. Both vulnerabilities received a severity score of 9.2 out of 10 on the industry's standard scale, classifying them as 'critical'.

The two flaws, collectively nicknamed PHP2Shell, were independently discovered by two cybersecurity companies utilizing AI. Calif, in collaboration with OpenAI, reported the first flaw on August 11. Wiz, a company owned by Google, reported the second on August 24. These vulnerabilities had been present in the PHP codebase for over a decade and would have been exceptionally difficult for human hackers to exploit, Wiz stated. Calif and Wiz confirmed they had coordinated with each other, the PHP team, and OpenAI before the vulnerabilities were made public. However, Amazon's chief security officer, CJ Moses, revealed that his security team detected an attempt to exploit these vulnerabilities on October 17, four days before the public disclosure. Moses noted that it remains unclear how the hacker became aware of the flaws while the reports from Calif and Wiz were still under embargo. Typically, security researchers maintain secrecy regarding vulnerabilities until a fix is prepared to prevent their exploitation by attackers.

Who can potentially be affected?

PHP, a programming language dating back to the early 1990s and originally an acronym for Personal Home Page, forms the backbone of substantial portions of the public internet. Its integration into platforms like WordPress, Drupal, Joomla, and Magento means that any critical vulnerability carries potentially enormous ripple effects. Calif, Wiz, and the web infrastructure company Cloudflare have indicated that the flaws impact PHP versions 5.4 and later, encompassing more than a decade of releases. Cullen emphasized the 'unprecedented' nature of the vulnerability, highlighting that PHP powers over 70 percent of global websites, though actively updated sites are now protected. "There is a real risk to the kind of shared digital infrastructure that we all rely on," Cullen told Al Jazeera. "There is concern in the cybersecurity community about what the blast radius for this will be, even though the developers of PHP have been very quick to try and develop patches for it." Cullen also observed that while AI is advancing in cybersecurity, it is simultaneously improving its capabilities as a hacking tool. "This means that we are developing systems… that are making the internet safer by helping to fix bugs, but we’re also making it riskier by discovering bugs and creating bugs they’ll be able to hack," he commented.

What has the impact been so far?

In the Netherlands, the national cybersecurity agency took its own services offline as a precautionary measure due to the vulnerabilities. Several other organizations followed suit, temporarily disabling public-facing websites. These included the Port of Rotterdam, the government portal Overheid.nl, the national football association KNVB, the websites for the Netherlands' five largest political parties, and multiple hospital websites. Dutch Prime Minister Rob Jetten stated he was closely monitoring the situation. Disruptions were also significant in Finland, where the state IT services provider Valtori took government public network services offline as a precautionary measure. France's Ministry of the Interior placed all of its websites under preventive maintenance. Belgium's Federal Public Service Foreign Affairs, Foreign Trade and Development Cooperation temporarily took its websites offline following reports of cyberattacks exploiting the PHP vulnerabilities, although the country's cybersecurity center reported no attacks on Belgian websites. South Korea's government elevated its private-sector cybersecurity alert level and activated emergency response measures. It issued security guidance to approximately 28,000 companies with registered chief information security officers, 5,900 members of a government information-sharing network, and operators of critical infrastructure, web-hosting firms, and data centers. Wikipedia, the online encyclopedia, announced it had taken down an unspecified number of systems until they could be safely patched. The Internet Archive, a vast digital library, also briefly went offline to address the issue.