AI Uncovers Critical PHP Vulnerabilities, Sparking Global Server Update Rush
Translated & summarized from Bizportal by baba
Global cybersecurity teams are rushing to update servers running PHP due to two critical vulnerabilities, PHP2Shell, discovered with AI assistance. These flaws allow remote code execution and data theft, impacting millions of websites. PHP has released patches, but experts warn of the accelerating pace of AI-driven discoveries and the need for immediate, thorough updates and system restarts.
The story in 6 lines · by baba
- Two critical PHP vulnerabilities, PHP2Shell, discovered with AI, allow remote code execution on 70% of websites.
- Global cybersecurity teams are working urgently to update servers running the PHP programming language.
- The flaws affect PHP versions from 5.4 to 8.5.11, released over the past decade.
- Israeli firm Veez demonstrated exploitation on major platforms like WordPress and data exfiltration.
- PHP has released updated versions, urging immediate installation to mitigate risks.
- Experts warn this is the beginning of faster, AI-driven vulnerability discovery and exploitation.
Global cybersecurity teams are working around the clock to update servers running PHP, the programming language powering approximately 70% of websites, following the discovery of two critical vulnerabilities dubbed PHP2Shell. These flaws, rated 9.2 out of 10 for severity, allow attackers to execute remote code without authentication, affecting PHP versions from 5.4 to 8.5.11, released over the last decade. The vulnerabilities stem from how PHP handles memory management, specifically when running out of memory or when data from one request persists into another. The issue lies within the core language itself, not just applications built on it. Israeli cybersecurity firm Veez demonstrated successful exploitation on WordPress, Drupal, and Joomla, noting that even simple text-based applications could be vulnerable. They also showed that sensitive data like passwords and access keys could be exfiltrated from server memory. Veez discovered the first vulnerability on August 19th using AI models from Google and OpenAI, reporting it to the PHP security team five days later, with a fix released on October 21st. Another research company, Calif, found similar issues around early August. The situation escalated when details of the vulnerabilities leaked online before the official release of the patch, causing widespread alarm and prompting the "Black October" moniker for this period. PHP has released updated versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35) and urges all users to update immediately, especially those using Apache with mod_php, which is at higher risk. Older versions (8.1 and below) are out of support, but limited patches are available. The US Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert, recommending that organizations unable to update immediately disconnect affected systems from the network. The UK National Health Service and Google Cloud have also issued warnings and directives to their users. Experts caution that simply installing the update may not be enough; servers require a full restart to clear old code from memory, and containers need to be rebuilt. The industry views this as a precursor to more AI-driven vulnerability discoveries, with experts predicting a worsening situation before improvement and urging increased security resources.
