PHP code risk: Urgent security fix issued for code vital to estimated 70% of all websites

PHP may not be a household name, but the programming language, released over 30 years ago, powers a large share of websites and web applications. Nearly 70% of the internet is estimated to use PHP, including WordPress, which is used for more than 40% of websites.

Now the PHP development team is urging users to update immediately after fixing two critical vulnerabilities, rated 9.2 out of 10 in terms of danger, that if exploited could allow attackers to take over internet servers.

On Wednesday, the PHP development team released updates that “fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately,” according to the official PHP website.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday said it “strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP,” noting that while it “has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.” 

Likewise, the FBI Cyber Division urged all potentially affected organizations to “immediately update affected PHP installations.”

“If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated,” the FBI said.

The U.K. government’s National Cyber Security Centre also encouraged organizations “to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated.”

Open AI posted Wednesday morning that their AI models helped researchers discover the PHP flaws.

“Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure,” the post said, in part. “Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.”

The company added that they believe their AI model identified the problems before hackers could exploit the vulnerabilities. 

OpenAI has come under increased scrutiny in recent months following disclosures that their AI models attacked numerous websites, including U.S. government websites and those of rival AI companies.

In an online post later Wednesday, the PHP Foundation said “a potential exploit” for the code problem was theorized as early as 2024, “but no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns.” Work on the fix continued sporadically over the ensuing years due to relevant experts being “occupied with many responsibilities,” which in turn “caused work on a fix to stall and restart repeatedly over months.”

The PHP Foundation says it entered the PHP project into OpenAI’s Patch the Planet program and a security audit began in July. In September, OpenAI identified ways the vulnerabilities could be exploited, according to the PHP Foundation, which said that information – and additional reports from a security researcher and the website provider Wiz – convinced them that fixing the issue needed to be “top priority” and they began that work on August 11.

Once the vulnerabilities “began circulating on online forums and social media” in recent days, the PHP development team decided to push forward its planned announcement and fix, the post said.

“We won’t pretend otherwise: the delay was a structural failure,” the post added.

In a blog post Wednesday evening, Amazon Threat Intelligence says it detected a hacking attempt on Oct. 17 that suggests a threat actor may have known about the vulnerabilities four days before the PHP developers went public with the problems and the fix. The attempt targeted one of Amazon’s decoy systems, which it uses to track attackers. Amazon says it’s unclear how the actor learned about the flaws before the announcement.

Amazon says it identified several more attempts on the day of the announcement, some just hours before the fix was released. The company says that varied methods used to exploit the flaws suggest multiple attackers. As it was a decoy system, Amazon says it’s unclear whether any of the attempts would have worked on real systems.

“Once the embargo was lifted and the patch was released, additional proof-of-concept exploits appeared within hours, and we saw them used against our sensors almost immediately. PHP2Shell is now being broadly exploited in the wild,” said Amazon.

Amazon warns that because attackers are now moving faster than in the past, organizations should apply critical fixes for internet-facing systems within hours, not days or weeks. It also says they should check for signs of break-ins going back to Oct. 17.

Before the PHP fix was released, the cybersecurity firm watchTowr said Tuesday it believed the vulnerabilities “could let attackers run their own code on affected servers” and that “organizations running PHP in production should prepare to update quickly once an official fix is released.”

The PHP team said updating the code is the only complete fix. While it lists temporary measures to address the vulnerabilities, such as adjusting memory and upload settings, it notes that those measures only reduce exposure and do not make a server safe from potential exploitation.