Millions of websites could be at risk after two security flaws were discovered in PHP, a programming language used by about seven in 10 websites worldwide. Governments and businesses have taken some websites offline while they install security updates to prevent hackers from exploiting the flaws. Security firm Hadrian says attacks are already taking place on a large scale.
The vulnerabilities could allow attackers to corrupt a website’s memory and gain access to the server behind it, including its files and databases. Security experts have urged organisations to install the available patches immediately or take vulnerable services offline.
PHP is an open-source programming language that has been used for more than 30 years. It powers websites and content management systems, including WordPress. Wikipedia and Facebook are among the major services that use it.
The flaws also affect Drupal, a web platform used by governments around the world. In Australia, 391 government websites run on GovCMS, a platform built on Drupal.
The vulnerabilities have been named PHP2Shell by security company Hadrian. They affect two core parts of PHP: memory management and error handling. Almost every request processed by PHP passes through these functions, making the flaws serious and difficult to fix without disrupting existing websites, reducing performance or breaking compatibility with other software.
The US National Security Agency said the flaws could “provide a direct path to the server’s file system or database”.
Some website operators have temporarily shut down their services to install security updates. Many sites returned quickly, but experts warn that websites which remain online may still be vulnerable if they have not been patched.
Sigi Goode, a professor of information systems at the Australian National University, said the websites that had gone offline to install fixes were not the main concern.
“The bigger concern is the websites that are not down today. Users should be wary of these, as they are clear targets.”
Hadrian said it was seeing “exploitation happening at scale” after information about the vulnerabilities began circulating online.
The company advised organisations to take vulnerable services offline if they could not install the fixes immediately.
“Shutting down a service for a few hours costs far less than a compromised server,” Hadrian said.
The PHP Foundation, the non-profit organisation that maintains the language, said the vulnerabilities were particularly serious because they affected functions used throughout PHP.
Their central role made the flaws difficult to fix without affecting compatibility, performance or the large number of third-party extensions that rely on the language.
The vulnerabilities were discovered in mid-August through work involving artificial intelligence (AI) and an independent security researcher, Ryan A.
The PHP Foundation said it had worked with an advanced AI model developed by Anthropic to scan its code. PHP was also included in OpenAI’s Patch the Planet programme, which searches for software vulnerabilities.
The flaws were due to be made public on 22 October. The delay was intended to give website operators time to prepare and install security updates before hackers could use the information.
But the PHP Foundation said details of the vulnerabilities began circulating on online forums and social media on Tuesday, according to Coordinated Universal Time (UTC). It brought forward the disclosure as a result.
It remains unclear whether someone deliberately leaked the information.
Amazon Threat Intelligence said it had identified an attempted exploitation of the vulnerabilities four days before their public disclosure. The activity targeted a honeypot, a decoy system used by security teams to detect and study attacks.
“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” Amazon said.
Amazon also identified several proof-of-concept exploits on the day the disclosure was due. These are demonstrations of how a vulnerability could be exploited, rather than necessarily being attacks that cause damage.
The PHP Foundation said some security companies had also published information about the flaws before the embargo ended.
AI tools can help researchers identify weaknesses in software much faster than traditional methods. Some flaws that might have taken human researchers months or years to find can now be detected more quickly.
The technology also gives attackers new ways to identify weaknesses and develop exploits, increasing the pressure on organisations to secure their systems.
Don Smith, vice-president of threat intelligence at cybersecurity firm Sophos Counter Threat Unit, said the first challenge was identifying every system running PHP.
“The immediate challenge is not simply installing a patch, but finding and managing every instance where PHP is running,” he said.
Smith warned that attackers were likely to target the vulnerabilities in the coming hours and days.
“Threat actors move fast, especially with the help of AI, and this will likely be a priority target for them over the coming hours and days so it is crucial organisations monitor PHP and web-server processes for unusual processes, command execution or other signs that an attacker may already have gained a foothold,” he said.
The incident has also drawn attention to how much modern internet infrastructure depends on software maintained by small teams.
The PHP Foundation relies on financial contributions and has only 13 full-time and part-time engineers maintaining the language, despite its use across a large part of the internet. That contrasts with the billions of dollars invested in developing AI.
The issue echoes a warning made in a cartoon by Randall Munroe, the creator of the webcomic XKCD. His cartoon highlighted the risks of relying on essential infrastructure maintained by a small group of people or even a single person.
Website operators have patches available, but applying them across all systems remains a major task. Experts say organisations must check every instance of PHP, install the updates and monitor their servers for signs of an attack.
