Critical PHP flaws raise cyberattack fears worldwide

Two critical security flaws in PHP, a programming language that powers a large number of websites worldwide, could allow hackers to break into vulnerable servers without logging in. Attackers could run harmful programs remotely, steal sensitive information and potentially compromise websites.

Dubbed ‘PHP2Shell’, the flaws could allow hackers to break into vulnerable servers, run harmful commands and access sensitive information without logging in. This could put websites and the data they store at risk.

Amazon said its threat intelligence team detected an attempt to exploit the vulnerabilities, days before they were publicly disclosed. The activity was identified through its MadPot threat detection network, which monitors suspicious activity across internet-connected systems. Amazon said it remained unclear how the attacker obtained information about the flaws before their public disclosure. It later detected further attempts to exploit the vulnerabilities.

The discovery has also highlighted the growing role of artificial intelligence (AI) in cybersecurity research. Google’s cloud security unit, Wiz, said its researchers used AI models to identify the vulnerabilities, test how they could be exploited and help check security fixes. The company said its Gemini AI model played an important role in the research.

OpenAI also contributed to the research and the process of informing the public about the flaws. The effort involved software developers, technology companies and security specialists working together to prepare fixes and guidance before the vulnerabilities were publicly disclosed.

Government agencies have issued warnings, urging organisations to identify affected systems and install security updates without delay.

The US National Security Agency said the flaws could allow attackers to take control of affected web servers, steal sensitive data, disrupt services or gain access to other parts of a network. It urged organisations to identify systems running vulnerable PHP versions and install the necessary updates.

The European Union Agency for Cybersecurity and other European cybersecurity bodies also advised organisations to apply the updates. They recommended restricting public access to affected applications if immediate fixes were not possible. Canada’s Cyber Centre issued a similar warning, highlighting the risks to PHP systems accessible through the internet.

Security experts have urged organisations to update affected PHP installations promptly and check third-party applications and services that may contain vulnerable PHP components.