AI Aids Discovery of Critical PHP Vulnerabilities, Sparking Global Security Alert
Translated & summarized from Bizportal by baba
Global cybersecurity teams are urgently updating servers running PHP due to two critical vulnerabilities, PHP2Shell, discovered with the help of AI. These flaws allow remote code execution and data theft, affecting most websites built with the language over the past decade. The PHP project has released patches, and agencies like CISA have issued alerts, though no exploitation has been confirmed in the wild. Experts warn this is the beginning of a trend where AI will accelerate vulnerability discovery, potentially overwhelming defenses.
The story in 6 lines · by baba
- Two critical PHP vulnerabilities, PHP2Shell, discovered with AI assistance, allow remote code execution.
- Approximately 70% of websites are affected, impacting all PHP versions from 5.4 to 8.5.11.
- Israeli firm Veez demonstrated exploitation on major platforms like WordPress, Drupal, and Joomla.
- The PHP project has released updated versions, urging immediate installation of patches.
- CISA and other agencies have issued urgent alerts, though no exploitation in the wild is confirmed.
- Experts predict AI will accelerate vulnerability discovery, posing a growing challenge to cybersecurity.
Global cybersecurity teams are working around the clock to update servers running PHP, the programming language used by approximately 70% of websites, following the discovery of two critical vulnerabilities dubbed PHP2Shell. These flaws, rated 9.2 out of 10, allow attackers to execute remote code without authentication. They affect all PHP versions from 5.4 to 8.5.11, released over the last decade. The first vulnerability, CVE-2026-109618, relates to how PHP handles memory exhaustion, while the second, CVE-2026-109619, involves data from one request persisting and being used by subsequent requests. These issues reside within the core language, not specific applications. Israeli cybersecurity firm Veez demonstrated successful exploitation on WordPress, Drupal, and Joomla, noting that even simple text-based applications could be vulnerable. They also showed that sensitive data, including passwords and access keys, could be exfiltrated from server memory. Veez discovered the first vulnerability on August 19 using AI models from Google and OpenAI, reporting it to the PHP security team five days later, with a fix released on October 21. A separate research company, Calif, reported similar findings around early August. A file detailing the vulnerabilities circulated online before the official release, accelerating the alert. The PHP project has released updated versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35) and urges immediate updates, particularly warning about Apache servers with mod_php. Older versions are out of support, but patches are available for some. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert, noting no confirmed exploitation in the wild as of its update but recommending disconnecting vulnerable systems if immediate patching is impossible. The UK's National Health Service and Google Cloud have also issued warnings and directives to customers. Experts caution that simply installing the update may not be enough, as servers need to be restarted to clear old code from memory, and containerized environments require rebuilding. The discovery is seen as a sign of future threats, with experts predicting an increase in AI-driven vulnerability discovery that could outpace organizations' ability to fix them. Smaller businesses are advised to conduct regular scans, update promptly, and take down old systems. Individual users are reminded to use two-factor authentication, password managers, and separate networks for smart devices.
