The internet is cooked. PHP, the programming language that is behind a large portion of websites today, has two major cybersecurity flaws that could allow hackers to gain remote control of the platforms. The situation has reached a stage where the US National Security Agency (NSA) has warned that if systems cannot be updated to the latest security patch, they must be made offline.
In an advisory, the NSA wrote, “If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.” The flaws, collectively nicknamed “PHP2Shell”, could allow attackers to take control of affected web servers without prior access or authentication. The FBI shared a similar warning.
The PHP Foundation pushed an emergency security release on October 21, fixing the two vulnerabilities in question. The flaws had reportedly remained undetected for more than a decade before researchers found them after using advanced AI tools for several weeks.
What is PHP?
PHP, short for PHP: Hypertext Preprocessor, is a programming language that runs websites. When you load a page, the server that runs on PHP brings the content together and sends the finished webpage to your browser. PHP is open source, and maintained by volunteers.
According to web tracker W3Techs, PHP runs nearly 70 per cent of all websites whose programming language can be identified. This means that the vulnerabilities could expose a large part of the internet as we know it, including websites like Wikipedia or those hosted by WordPress.
“PHP2Shell” could give attackers access to a server’s file system or database, allowing them to steal sensitive information, disrupt services, install malware or move deeper into a network. The NSA said the flaws were in PHP itself rather than in hosted applications or their configuration, leaving servers running affected versions open to exploitation.
The PHP Foundation rated the vulnerabilities at 9.2 on a scale of 10.
Dr Kanishk Agrawal, CEO of Path AI Technologies, says that such flaws in PHP could disrupt the internet. “Any vulnerability in PHP can cause the failure of several applications at once especially in case organizations deploy outdated versions or make vulnerable types of services available in the network,” he tells India Today Tech.
OpenAI says ChatGPT found PHP flaws
OpenAI has revealed that it was its AI models which found these vulnerabilities. “Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory,” OpenAI said on X.
The critical vulnerability was first identified by Calif.IO using GPT-5.6 Sol, while cyber-security firm Wiz independently found and reported both vulnerabilities. PHP maintainers led the work on fixes, supported by OpenAI, Wiz, Cloudflare and other partners.
OpenAI claimed that the work to fix the issues took about two months and required a major change to the PHP engine. OpenAI also released a PHP version checker as a Codex skill to help operators identify potentially vulnerable versions. It is also committing $1 billion in subsidised access for “organisations with limited security resources protecting essential services.”
Japan PM warns of PHP flaws, countries take down websites
The PHP flaws have raised concerns on a global scale. Japan’s Prime Minister Sanae Takaichi issued an urgent appeal, while public services and websites in Finland, the Netherlands and the UK were taken offline as a precaution.
“Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight at 11 PM on October 21 (Japan time) as soon as possible,” Takaichi wrote on X. “If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk.”
Meanwhile Finland temporarily shut the government’s public web services, and the Netherlands’ cyber-security agency took its own website offline. Websites belonging to the Dutch public health institute and the lower house of parliament also became inaccessible. The Wikimedia Foundation said it had taken down several systems as a precaution until they could be safely patched, affecting access to parts of Wikipedia.
Cyber-security agencies in the UK, European Union, Australia and Japan also urged users to install the fixes. CERT-EU said the flaws could affect versions dating back to PHP 5, launched in 2004, while the PHP Foundation issued updates only for the latest versions and advised users of PHP 8.1 or older to upgrade.
The precautions around the flaws come after details of the vulnerabilities were leaked on social media, which forced the PHP Foundation to bring forward its announcement.
And it appears that cyberattacks have already begun. Cloudflare CEO Matthew Prince revealed that the company was witnessing thousands of attempts by hackers who want to exploit these flaws. “In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it,” he wrote on X. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
Rajesh Chhabra, general manager at Acronis, says that while AI tools have made it easier to find such flaws, it may be a double-edged sword. “AI tools are shrinking the gap between a patch release and a working exploit, so patching has to be treated as urgent operational work,” he tells India Today Tech. “An attacker who exploits them could run commands on a server, steal data, install web shells and move deeper into connected systems.”
The PHP incident comes at the same time as some other cybersecurity incidents. Recently, it was found that India’s eMudra used shockingly weak security keys for digital certificates. The State Bank of India (SBI) also confirmed that it had faced a cyberattack this week.
– Ends
Leave a Reply