Critical PHP vulnerabilities send organizations scrambling to secure their systems

Critical PHP vulnerabilities send organizations scrambling to secure their systems

The maintainers of the PHP programming language today released patches for two critical vulnerabilities that affect up to 70% of the world’s websites.

Several cybersecurity agencies including the NSA are urging organizations to shut down affected systems while they implement the updates. Many municipalities, schools and private companies have taken their advice. Content delivery network operators Cloudflare Inc. and Fastly Inc., meanwhile, reported that hackers are already trying to exploit the bugs. 

“This is not a theoretical vulnerability,” said Fastly chief product officer Kelly Shortridge. “We observe many billions of PHP requests a day across Fastly’s global network, and we are seeing evidence of active attacks.”

The two exploits are together known as PHP2Shell. They enable hackers to deploy malicious code on vulnerable servers. The installation process takes only a few seconds in some cases. Once the malware compromises a website, it can read its database and launch cyberattacks against visitors.

The first PHP2Shell exploit emerges when a piece of PHP code receives more data than it can process. PHP responds to such situations by deleting some of the ingested data. According to the language’s maintainers, the data left over after that operation can be used by hackers to launch cyberattacks.

The second PHP2Shell exploit relates to global state, information that is shared by multiple components of a program. Each piece of global state is associated with a specific request to a PHP application. When the application processes a request, it deletes the associated global state. PHP2Shell enables malicious code to access some of that data before it’s deleted, which opens the door to cyberattacks.

“This is about as broad as a critical vulnerability gets,” said Moshe Siman Tov Bustan, a cybersecurity research team lead at application security startup OX Security Inc. “If you have a publicly accessible PHP instance and haven’t patched it, start from the assumption that you’re exposed. If you find evidence of exploitation, assume compromise, not just exposure.”

The underlying technical issue behind PHP2Shell has been present in PHP for decades. However, researchers believed that it can’t be exploited in practice. That changed in August, when an employee of cybersecurity company Calif.io Inc. used GPT-5.6 Sol to scan PHP’s code base for bugs. The audit, which was financed by OpenAI Group PBC, revealed that PHP2Shell can be targeted after all.

Google LLC’s Wiz cybersecurity unit made a number of additional discoveries about the issue shortly thereafter. Over the following weeks, tech firms and cybersecurity researchers formed an industry group to tackle PHP2Shell. The effort reportedly produced more than 10,000 lines of code and fixes spanning over 20 PHP files.

The consortium originally planned to release the patch on Thursday, but the vulnerability was leaked yesterday on a popular developer forum. That led PHP’s maintainers to rush out the fixes today. 

“A leaked embargo is a leadership test as much as a technical one, because the decisions that matter today get made before anyone has full details,” said Andrew Obadiaru, the Chief Information Security Officer of cybersecurity company Cobalt Inc. “Security leaders need to be able to answer a few questions quickly: where PHP is running, who owns each of those systems, and who has the authority to take something offline if it can’t be patched.”

“PHP has been embedded in websites, applications and third-party software for decades, and many organizations are still running older versions that no longer receive standard security updates. For those systems, ‘drop everything and patch’ isn’t always an option,” explained Itai Goldman, the co-founder and Chief Technology Officer of vulnerability mitigation startup Miggo Ltd. “Security teams need to identify their exposure now, prioritize internet-facing systems and work with vendors on upgrade paths or supported fixes.”

Cloudflare has updated its CDN to shield customer websites from PHP2Shell cyberattacks. However, the company stressed that users should still patch their systems. CrowdStrike Holdings Inc. and several other enterprise cybersecurity providers have also added mitigations to their products. OpenAI, for its part, released a tool that can help users of its Codex coding assistant find vulnerable PHP installations in their systems.

Image: Pixabay