PHP powers most of the web

PHP, released over thirty years ago, powers nearly seventy percent of the internet. WordPress, which runs more than forty percent of websites, is built on PHP.

Two critical vulnerabilities found

The PHP development team fixed two critical vulnerabilities rated nine point two out of ten in danger. If exploited, they could allow attackers to take over internet servers.

Immediate updates urged

On Wednesday, the PHP development team released updates fixing vulnerabilities that allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

“fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately”

US cybersecurity agencies respond

The US Cybersecurity and Infrastructure Security Agency and FBI Cyber Division both urged organizations to immediately patch the vulnerabilities. CISA noted it has not observed exploitation as of publication.

UK and FBI offline guidance

The FBI said if immediate update is not feasible, organizations should take systems offline until fully mitigated. The UK National Cyber Security Centre gave the same guidance.

“If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated”

OpenAI's AI found the flaws

OpenAI posted Wednesday that their AI models helped researchers discover the PHP flaws. The company believes their AI identified the problems before hackers could exploit them.

“Due to the severity of these flaws and PHP's widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory”

Delay was structural failure

A potential exploit was theorized in two thousand twenty-four but no concrete vectors were found. Work stalled repeatedly over months due to experts being occupied with other responsibilities.

“We won't pretend otherwise: the delay was a structural failure”

Attackers may have known early

Amazon Threat Intelligence detected a hacking attempt on October seventeenth, four days before the fix was announced. Amazon says it is unclear how the actor learned about the flaws beforehand.

Exploits spreading rapidly

Once the patch was released, proof-of-concept exploits appeared within hours. Amazon says PHP two Shell is now being broadly exploited in the wild with multiple attackers using varied methods.

“PHP2Shell is now being broadly exploited in the wild”

Organizations must act fast

Amazon warns organizations should apply critical fixes for internet-facing systems within hours, not days or weeks. They should check for signs of break-ins going back to October seventeenth.