These flaws rank among the ‘most severe vulnerabilities’ arguably discovered in software history, Wiz said.
Several websites, from governments and other critical services, to businesses, were taken down yesterday (21 October), to fix a critical security flaw discovered using frontier AI models.
PHP is a popular server-side scripting language designed for web development, used by nearly 70pc of websites globally. The open source language interacts with web page content and databases, and handles backend and logic before delivering the final output to a user’s browser.
The two critical flaws, rated 9.2 out of 10 on the CVSS v4.0 severity scale – a standard industry scoring system – could have allowed for attackers to execute malicious code on vulnerable servers, expose customer data, or disrupt services, Cloudflare said. It warned that since widely used platforms such as WordPress and Magento are built on PHP, the flaw could affect a large number of websites.
These flaws “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” Wiz, the an Israeli cybersecurity, now under Alphabet, said.
“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps…frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”
The organisation first discovered the flaws in August as part of a coalition of researchers and security providers led by OpenAI’s Daybreak initiative. Calif, a security firm, identified a critical flaw, while Wiz also independently discovered and reported both flaws, OpenAI said. PHP’s maintainers issued a warning and led upgrades to the system.
Left unpatched, the vulnerabilities could allow an attacker to take control of a web server without needing a password, said ESET Ireland, which has urged Irish businesses to contact their web developer or hosting provider to confirm if their websites have been updated.
“Most Irish small business owners have never heard of PHP, but there’s a good chance their website runs on it,” said George Foley, a cybersecurity specialist at ESET Ireland.
“For the public, the risk is quieter. When criminals take over a genuine website, they use it to push malware or fake login pages to people who trust that site. Over the coming days, be careful with any unexpected download or payment request, even on websites you know.
“Expect the scammers to move fast too. Emails telling businesses their site has been hacked and needs an urgent fix through a link are a near certainty. Go to your web provider directly, never through a link in an email.”
Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.