Fixes are out for two serious bugs in the language behind much of the web, but experts warn hackers are racing to exploit unpatched sites.
Government agencies, hospitals and major online services took websites offline on Wednesday after the disclosure of critical flaws in PHP, the programming language that runs a large share of the internet. Developers of PHP released urgent fixes and urged all users to update immediately.
The two vulnerabilities, nicknamed “PHP2shell,” could let attackers run their own code on a server without logging in, according to PHP’s security advisory as reported by ABC News. The bugs had been hidden in the code for more than a decade. Security firms Calif and Wiz said they found them with the help of artificial intelligence, and both said they coordinated with the PHP team.
PHP runs roughly 75% of websites whose programming language can be identified, according to W3Techs, and sits inside WordPress, Drupal, Joomla and Magento sites. Drupal Association interim chief executive Tiffany Farriss said any server using a PHP version from the past 20 years is vulnerable. Internet intelligence firm Censys found that about 1.5 million of 2.6 million hosts it examined report running a PHP version with no fix available, Reuters reported.
The disruption was widest in Europe. The Dutch cybersecurity agency went offline as a precaution, along with the Port of Rotterdam, the government portal Overheid.nl, several hospital websites and the sites of the five largest Dutch political parties. Finland’s state IT provider took government public network services offline, and France’s Interior Ministry put all its websites into preventive maintenance. The operator of Wikipedia said it took down some systems until they could be patched, and the Internet Archive briefly went offline. In Australia, the cybersecurity agency issued a rare critical alert, the government web host GovCMS blocked direct access to its servers, and the education software provider Moodle took its website offline before restoring it after applying fixes.
Experts warned the worst may not be over. Because the fix is public and AI tools can help reverse-engineer the bug, researchers said they expect a wave of attacks. Costin Raiu of cybersecurity firm TLP:Black called it a “race to exploit.” Amazon Web Services said it saw an attempt to exploit the flaw as early as October 17, before the public disclosure. Risks are higher for small sites on shared hosting, where owners don’t control the underlying servers. Automattic said users of its hosted WordPress.com service and Tumblr were safe. OpenAI warned that the same AI capabilities that help defenders find flaws could help attackers build exploits faster.
For the public, there is little to do about servers they don’t control. Security expert Troy Hunt told ABC News that people should expect more data breaches than usual. ABC’s practical advice is to use unique passwords or passkeys with a password manager, watch card statements over the coming weeks, and be wary of unexpected login or download prompts, even on trusted sites. Website operators should update PHP immediately or take sites offline until they can.
This report draws on information from Reuters and ABC News.