Copyright protected content copied from PhoneWorld website.
A serious security flaw in PHP, one of the internet’s most widely used programming languages, has raised concerns among governments, businesses, and cybersecurity experts. The flaw could allow hackers to launch cyberattacks and access sensitive data if website owners fail to install the necessary security updates.
PHP powers an estimated 70% of websites worldwide, making the vulnerability a major concern for the global internet. Several governments and organisations have taken immediate action to secure their systems, while some websites were temporarily taken offline to apply security fixes.
What Is PHP and Why Is It Important?
PHP is an open-source scripting language that has been around for more than 30 years. Developers use it to build websites, manage content, and run server-side applications.
Popular content management systems, including WordPress, rely on PHP to operate. Millions of websites use the language, including major online platforms such as Wikipedia and Facebook.
Because PHP supports such a large part of the internet, a security issue affecting its core components can put a vast number of websites at risk.
The impact has already reached government systems. In the United Kingdom, the National Cyber Security Centre (NCSC) sent around 50,000 alerts to organisations running affected systems. Government websites in France, the Netherlands, Canada, Japan, and Germany were also temporarily taken offline as a precaution while administrators applied security updates.
What Is the PHP Vulnerability?
The PHP Foundation, the organisation responsible for maintaining the language, identified two serious vulnerabilities affecting memory management and error handling. These components play a role in processing many website requests.
Cybersecurity company Hadrian described the exploitation method as “PHP2Shell.”
The vulnerabilities could allow attackers to corrupt a website’s memory through specially crafted requests. Hackers could potentially use this weakness to execute malicious commands and gain access to a server’s file system or database.
According to the US National Security Agency, the vulnerabilities could provide attackers with a direct route to sensitive server resources.
If criminals successfully exploit the flaw, they could potentially steal data, compromise websites, or gain further access to affected systems.
Artificial Intelligence Helped Discover the Flaw
Artificial intelligence played an important role in identifying the security weaknesses. AI systems can analyse large amounts of source code and identify potential vulnerabilities much faster than traditional manual reviews.
The PHP Foundation said it worked with Anthropic’s advanced AI model to scan PHP code. The language was also included in OpenAI’s Patch the Planet programme, which identified the issue around the same time as security researcher Ryan A in mid-August.
The vulnerabilities were scheduled for public disclosure on October 22, allowing website operators time to prepare and install fixes.
However, the PHP Foundation reported that information about the vulnerabilities began circulating on online forums and social media before the planned announcement. It therefore brought forward the disclosure.
The NCSC warned that the early circulation created a window of approximately 12 to 14 hours during which attackers could search for vulnerable websites before administrators had an opportunity to apply patches.
How Serious Is the Threat?
The scale of the problem makes the vulnerabilities particularly concerning. Since the affected components handle many routine PHP operations, fixing them without affecting performance, compatibility, or third-party extensions presented a significant technical challenge.
Following the public disclosure, Hadrian reported seeing exploitation attempts on a large scale. Amazon Threat Intelligence also identified activity that appeared to target a vulnerable system before the official announcement.
Amazon reported detecting an exploitation attempt against a honeypot four days before public disclosure. A honeypot is a deliberately monitored system used by security teams to detect suspicious activity. However, researchers could not confirm how the attacker obtained information about the vulnerability before its release.
Despite these warnings, the NCSC reported that it had not observed any successful attacks during the first 24 hours after the vulnerabilities were announced.
This does not mean that all affected websites are safe. Attackers may continue searching for systems that have not received the necessary updates.
Security Updates Are Available
Security patches have already been released, and website owners are being urged to install them immediately. Some organisations temporarily shut down their websites and services to reduce the risk of an attack while they applied the fixes.
Cybersecurity experts have warned that temporarily taking a service offline may be safer than leaving a vulnerable server exposed.
However, identifying every affected system remains a major challenge. Businesses and government departments may operate multiple servers, applications, and third-party services that depend on PHP.
Don Smith, vice-president of threat intelligence at Sophos Counter Threat Unit, said organisations must identify and manage every instance where PHP is running rather than simply installing a patch on a single system.
Experts have also warned users to remain cautious about websites that have not taken visible steps to address the issue. Vulnerable systems that remain online could attract further attacks.
Is AI Making Cybersecurity Risks Worse?
The discovery highlights the growing role of AI in cybersecurity. AI tools can identify software weaknesses that human researchers might take months or years to discover.
Although this can help developers fix security problems earlier, the same capabilities can also benefit cybercriminals. Attackers can use AI to discover weaknesses, develop exploitation methods, and search for vulnerable systems more efficiently.
This creates a race between security teams trying to protect their systems and criminals attempting to exploit newly discovered flaws before organisations can respond.
As AI-powered security research becomes more common, businesses may need to invest more in monitoring, software maintenance, and cybersecurity protection.
A Reminder About the Internet’s Software Infrastructure
The PHP vulnerability also highlights the importance of maintaining the software that supports much of the internet.
Despite its widespread use, the PHP Foundation relies on financial contributions and maintains the language with a team of just 13 full-time and part-time engineers. This is a relatively small team compared with the scale of the infrastructure that depends on PHP.
The incident demonstrates how a weakness in a widely used open-source project can affect governments, businesses, and millions of website users.
For now, the most important step for website operators is to identify affected systems and apply the available security updates without delay. As AI continues to accelerate vulnerability discovery, regular software maintenance and rapid security responses will become increasingly important.
The post Major PHP Security Flaw Puts 70% of Websites Worldwide at Risk appeared first on PhoneWorld.