UAE firms race to patch AI-discovered PHP flaw as thousands of servers face risk

Companies and hosting providers in the UAE are moving to close a newly disclosed set of PHP vulnerabilities known as PHP2Shell, deploying patched PHP packages, updating shared hosting environments and advising customers to check their runtime versions and restart web services, according to cybersecurity experts.

Pushkar Singh, regional head for Middle East and Africa  at Protectt.ai, said the response showed the UAE was at the forefront of proactive threat response and digital resilience.

Stay up to date with the latest news. Follow KT on WhatsApp Channels. 

He said it also reinforced that cybersecurity is “not a one-time compliance exercise” but a continuous operational activity that must include timely vulnerability patching, runtime protection and threat intelligence backed by coordinated response.

According to Censys, 4,691 internet-facing hosts in the UAE are potentially exposed to the flaws, representing 79.5 per cent of the country’s total versioned hosts. The UAE ranks 71st out of 233 countries and territories observed.

Singh said some estimates suggest three in four websites use PHP, so it is fair to infer that most UAE enterprise websites are affected.

The severity for each site, he added, depends on its patching status, whether the application is internal or external, and how PHP is used.

Global warnings

The UAE response follows urgent warnings abroad.

The US National Security Agency urged organisations to take websites offline if they cannot immediately fix the two flaws, which it said often give attackers a direct path to a server’s file system or database.

Tenable Research has classified the flaws as a “Vulnerability of Concern”, the highest level under its Vulnerability Watch programme.

Satnam Narang, Senior Staff Research Engineer at Tenable, said the classification is reserved for only the most severe flaws, given how widely PHP is used. He said nearly 70 per cent of websites whose server-side language is known run PHP.

The flaws sit in PHP itself, meaning every installation that handles web requests is at risk, Narang said. If exploited, they can allow unauthenticated remote code execution, while one of them can also leak memory.

“They are among the most consequential vulnerabilities since Log4Shell because of their reach and scope,” he said.

He added that they were discovered with AI assistance.

Gavin Millard, Vice President of Intelligence at Tenable, said PHP2Shell had sat for more than a decade in code that runs roughly seven in ten websites. It was found in August and disclosed this week, he said, with exploitation attempts seen within hours.

“What we’re seeing is attackers compare old code with the new and then work backward. AI makes that quick. Speed and exploitability matter more than severity now,” Millard said.

Patching timelines vary

How quickly organisations can fix the problem depends on how they run PHP, according to Narang.

Linux distributions and long-term support vendors received advance notice, so updated packages could arrive within hours to days. Less mainstream package sources may take days. The PHP project said the volunteer-maintained remirepo would not have updates on release day.

Systems running end-of-life versions of PHP could wait weeks or months, or may never be patched, he said. Products that bundle PHP form “the long tail”, as organisations must wait for their vendors to ship updates. Cloud-hosted systems are generally patched more readily, while self-hosted and on-premises applications require administrators to schedule fixes.

What firms should do

Meriam ElOuazzani, Vice President for Middle East, Turkey, and Africa at Censys, said organisations must identify affected PHP installations, apply security updates and verify that remediation has worked. Security teams should also investigate unusual activity and assess legacy systems that may be harder to patch.

“Without knowing what’s out there, organisations cannot identify vulnerabilities until attacks occur,” she said.

Millard said the real weakness is often the forgotten server. “Patching PHP is easy if you know where it’s running. Most organisations don’t, not completely,” he said, pointing to sites spun up “just for testing” years ago. “If you can’t patch it, protect it. If you can’t upgrade it, pull it down.”

Singh urged a multilayered approach built on runtime protection and Zero Trust, treating websites, mobile applications and AI agents as parts of a single digital trust chain.

Don Smith, Vice President of Threat Intelligence at Sophos Counter Threat Unit, said the vulnerabilities had so far proven harder to exploit than initially feared, but the danger has not passed.

“As UAE organisations, like those everywhere, continue to patch and remediate, it will be an important learning curve for companies of all sizes as well as the security industry as a whole,” he said. “We are in an age of vulnerability discovery, fuelled by advances in AI. While this creates problems in the short term, in the long term it will make our software ecosystem safer and more resilient.”