AI-discovered flaws in PHP prompt government site shutdowns and urgent patches

Governments in Europe, Asia and elsewhere took some websites offline on Wednesday after two newly disclosed security flaws in PHP, a programming language that powers much of the internet, prompted a rare public warning from the United States National Security Agency.^4,5

The flaws, dubbed PHP2Shell, were discovered with the help of artificial intelligence models, according to Al Jazeera. Both rely on accessing parts of computer memory without authorization and exploiting that access to run malicious code. Al Jazeera reported that an attacker could remotely run commands on a server running old PHP code over the internet, without a password or a legitimate account. The PHP Foundation, a nonprofit that supports the language, released a fix for the latest versions on Wednesday afternoon.^4,5

The NSA advised organizations to take their systems offline if they could not install the update immediately. “Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities,” the agency said in a social media post. In a separate post, it wrote: “These vulnerabilities often provide a direct path to the server’s file system or database,” according to the BBC.^4,5

Several European governments acted quickly. Finland temporarily shut down its government’s public web services, and Germany’s Federal Ministry for Digital Transformation and Government Modernisation said it took some websites offline as a preventative measure. France’s Ministry of the Interior deactivated the official websites of local administrative offices. Authorities in Belgium, the Netherlands and the Czech Republic also said they had shut sites to apply a security patch. The Netherlands’ National Institute for Public Health and the Environment took its website down, and the website of the Tweede Kamer, the lower house of the Dutch parliament, became inaccessible.^4,5

The disruption reached beyond government. The Wikimedia Foundation, which runs Wikipedia, said it was addressing the vulnerabilities. “We have taken down a number of other systems as a precautionary measure until they can be safely patched,” it said, and some users were unable to access parts of Wikipedia on Wednesday. Edinburgh council’s website also became inaccessible, as did the online homes of several BBC programmes, including Doctor Who and The Traitors. The BBC reported that neither body had confirmed a link to PHP, and that it had approached them for comment. The art platform DeviantArt said it was “temporarily down for maintenance” without giving a reason.⁴

The vulnerabilities were found by researchers at the security firms Calif and Wiz. Calif, along with the PHP Foundation, took part in a program started by OpenAI called Patch the Planet, which gave them access to the company’s advanced AI tools to find and fix flaws in web development languages. Al Jazeera reported that Calif, working with OpenAI, reported the first flaw on August 11, and that Wiz, a security firm owned by Alphabet, reported the second on August 24. OpenAI said in a blog post that the discovery was “one of the most impactful security issues in recent memory,” and the BBC reported that an internal OpenAI researcher had also found the issue around the same time as the other firms.^4,5

Wiz said the flaws were “the most severe vulnerabilities ever discovered” by AI, and it described the AI tools’ role in its own blog post. “Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours,” the company said. Wiz said the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.” The BBC reported that the flaws had gone undetected for more than a decade, while Al Jazeera said the underlying weaknesses had been present for decades.^4,5

Estimates of the reach of the problem differed between the reports. The BBC reported that Wiz had estimated “roughly 70%” of the internet is affected, a figure the BBC said it was unable to verify. Al Jazeera described PHP as used by more than 70 percent of websites. Neither report gave an independent count of how many sites were running vulnerable versions of the software.^4,5

Details of the flaws were leaked on social media on Tuesday, the BBC reported, which forced the PHP Foundation to rush out its announcement of the vulnerabilities and their scale. The foundation had intended to release its findings later this month, along with a complete fix. Not all versions are known to be affected. CERT-EU, the European Union’s computer emergency response team, said the flaws could affect all versions of PHP dating back to PHP 5, which launched in 2004. The PHP Foundation has issued the update only for the latest versions, and people using PHP 8.1 or older have been urged to upgrade.⁴

Security researchers described the risk in broader terms. Dane Knecht, chief technology officer at the internet infrastructure firm Cloudflare, said he was “seeing early attacks emerging and are updating mitigations as new vectors show up.” CERT-EU said the risk scores given to the vulnerabilities “indicate the potential for unauthenticated remote code execution.” Don Smith of the Sophos Counter Threat Unit told the BBC that PHP would “likely be a priority target” for hackers, adding that the immediate challenge was locating every instance where PHP was running. “The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it,” he said.⁴

The White House said federal agencies were working with leading AI labs to speed up a fix. Japanese Prime Minister Sanae Takaichi urged people to check whether their publicly available websites ran on PHP. The UK’s National Cyber Security Centre, along with its counterparts in the EU and Australia, urged those using PHP to apply the fixes. “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the NCSC said in a note.^4,5

The PHP Foundation said AI tools would make such weaknesses easier to find, and it called on technology companies to mount a coordinated response to avoid major disruption to online services. “Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing,” the foundation said in a statement.⁵