Website owners faced millions of attempts to exploit a serious security vulnerability in their programming language, it has emerged, triggering a rush by governments and businesses to fix the problem.
The newly discovered vulnerabilities in PHP, a programming language that underpins most websites, allows hackers to carry out cyber-attacks and steal data if not fixed. What were the vulnerabilities and why did they affect so many sites?
What is PHP?
PHP is an open-source scripting language that is more than 30 years old and used across much of the internet. Content management systems and publishing template systems such as Wordpress are built on PHP.
An estimated 70% of websites use PHP, with millions of sites affected by the vulnerabilities. Wikipedia and Facebook are among those. In the UK alone, the National Cyber Security Centre (NCSC) sent out 50,000 alerts to organisations with affected systems, while government websites in France, the Netherlands, Canada, Japan and Germany were taken down temporarily as a precaution while a fix was added.
What is the vulnerability?
According to the PHP Foundation, the not-for-profit that maintains PHP code, the issues “sit in parts of PHP that nearly every request touches: memory management and error handling”.
The two vulnerabilities were labelled by the security vendor Hadrian as a “PHP2Shell exploitation”.
The vulnerabilities work by corrupting the memory in a website through a request that can then be used to launch an attack and could “provide a direct path to the server’s file system or database”, according to the US National Security Agency.
How was it discovered?
Historically, researchers and cybersecurity experts would test systems for vulnerabilities and patch the issues when they were discovered – or patch when one system was attacked and a vulnerability was identified.
Artificial intelligence has now sped up this process as AI can be thrown at systems to identify potential issues that might not have been spotted by a human, and can do so in a much shorter time frame.
The PHP Foundation said it had worked with Anthropic’s frontier model to scan its code, and had PHP put into OpenAI’s Patch the Planet program, which discovered the issue at the same time as a researcher, Ryan A, in mid-August.
The disclosure of the vulnerabilities had been embargoed until 22 October, to give websites time to fix it. But according to the PHP Foundation, it discovered the two vulnerabilities had begun circulating on forums and social media on Tuesday and so brought forward the disclosure. The UK’s NCSC said this had created a 12- to 14-hour window for people to look for the vulnerability in websites before they could be patched.
How bad is it?
The breadth of the vulnerability appears to be unprecedented. As the PHP Foundation has said, the issues sit in parts of PHP that nearly every request touches: “Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions.”
Coupled with the sheer number of sites that rely on PHP, that makes it a massive problem that should be fixed as soon as possible. Now the flaw is out in the wild, Hadrian said it was seeing “exploitation happening at scale”. However, so far no major hacks appear to have occurred. In the 24 hours since the vulnerability was announced, the NCSC said it had not seen any successful hacks.
How long will it take to fix?
Patches are already available, and the reason a number of websites went down in the past few days was that people were working to patch their systems immediately. A number of the websites returned quickly.
Security companies have recommended patching straight away, and where it cannot be done immediately, systems should be taken offline. “Shutting down a service for a few hours costs far less than a compromised server,” Hadrian said.
However, it will depend on businesses and governments being aware they need to patch, and doing so quickly. “The immediate challenge is not simply installing a patch, but finding and managing every instance where PHP is running,” said Don Smith, the vice-president of threat intelligence at the cybersecurity firm Sophos Counter Threat Unit.
Sigi Goode, a professor of information systems at the Australian National University, said the sites that went down while a fix was carried out were not the problem. “The bigger concern is the websites that are not down today. Users should be wary of these, as they are clear targets.”
Did someone leak the vulnerability and break the embargo?
A number of security companies did break the embargo after the leak, according to the PHP Foundation, but Amazon Threat Intelligence said in a blogpost that it had identified a PHP2Shell exploitation attempt dating to four days before the public disclosure.
“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” it said.
On the day the embargo was due to lift, but before it had lifted, Amazon also identified “multiple proof-of-concept exploits for the vulnerability”. These are non-harmful demonstrations that a vulnerability exists, without actually using that vulnerability to launch an attack – akin to testing a door to see if it has a faulty lock.
Is AI making the internet more vulnerable to these sorts of issues?
With AI, it is much easier to find vulnerabilities. AI agents can now identify issues that would have taken humans months or years to find, and they are also finding ones people were not aware of.
It is why more updates have been issued lately for software on phones or computers and this is predicted to continue as AI exposes more software glitches. In an age of software dependency, that is likely to mean more money being spent on cybersecurity at all levels of the economy, from small to large businesses.
Part of the problem is that – with the exception of the most frontline models – AI is very easy for everyone to use. It leads to something of a race between people trying to protect their systems, and hackers looking to take advantage of AI-discovered vulnerabilities.
“Threat actors move fast, especially with the help of AI, and this will likely be a priority target for them over the coming hours and days, so it is crucial organisations monitor PHP and web-server processes for unusual processes, command execution or other signs that an attacker may already have gained a foothold,” Smith said.
Some on social media have also pointed to a prescient cartoon by Randall Munroe, who is behind the web comic XKCD, about the reliance of modern infrastructure on projects maintained by small groups or one person.
The PHP Foundation operates on financial contributions and maintains the language with only 13 full-time and part-time engineers, compared to the billions invested into developing AI.
