'PHP2Shell' Flaws Found With AI Put Up to 70% of the Web at Risk of Takeover
Researchers say the bugs, which sat in PHP for at least a decade, could let attackers seize servers; the FBI told organizations that can't patch to take sites offline.
Cybersecurity researchers are warning that hackers could exploit weaknesses in PHP, the programming language behind up to 70% of the world's websites and web applications, to steal user information and knock sites offline.
The bug, dubbed PHP2Shell, can target two security flaws in PHP, according to Voldemaras Kadys, head of security at Mediatech. Those weaknesses could let criminals seize control of unprotected website servers, install malware, steal customer data and even take sites down completely. PHP, short for "Personal Home Page," runs sites used by government agencies, social media platforms such as Facebook and reference sites such as Wikipedia. "The potential impact of these vulnerabilities may be huge, as most websites run on PHP," Kadys said in an email.
The flaws came to light when security researchers used an OpenAI artificial intelligence model to find the problem, Wall Street Journal reporter Robert McMillan, who first reported the issue, told CBS News. The bug had existed for at least a decade. "People knew something weird was going on," McMillan said, but no one had found a way to turn a bug that might crash a computer into one that would let someone run software they were not supposed to be able to run. "There are a lot of sites that I don't think even know that they have a problem, and they may find out the hard way."
The PHP Foundation, which includes developers who work on securing the language, said Wednesday that it had released fixes for the vulnerabilities along with update instructions. "If you run PHP, it is imperative that you update now," the group said, pointing to technical details on php.net. The FBI's cyber threat division, in a post on X, encouraged any organization that can't immediately patch its sites to temporarily take them offline.
For ordinary internet users, Kadys said, simply visiting a PHP site doesn't necessarily compromise a device. The risk is that attackers break into a site that holds personal information, such as an online shop or booking platform, and extract names, email and physical addresses and dates of birth. He said there is no reason to stop browsing or shopping, but people should be extra cautious about suspicious messages because it isn't known what data hackers may have taken, or from which sites. A vulnerable site is not necessarily a breached one.
Andrés Guerrero-Saade, vice president of intelligence and security research at SentinelOne, said the episode shows how AI is speeding up vulnerability research while also boosting the ability of bad actors to exploit flaws. The gap between a patch becoming available and attackers exploiting unpatched systems, he said, is "the whole game essentially," and AI has shortened that window, letting cybercriminals move much faster than in the past.
