NSA, FBI and CISA Tell Website Operators to Update PHP or Take Systems Offline Over “PHP2Shell” Flaws
Two critical vulnerabilities in PHP, the software behind much of the web, were disclosed publicly on Wednesday. Federal agencies urged operators to install the patch or take sites offline, and several European governments pulled sites down as a precaution.
Federal cybersecurity agencies urged organizations on Wednesday to update the software that runs much of the internet, or take their systems offline, after two critical vulnerabilities in the PHP programming language were disclosed publicly.
The flaws, collectively known as “php2shell,” could let attackers run commands on an affected web server without logging in, according to the National Security Agency, the FBI and the Cybersecurity and Infrastructure Security Agency. The agencies said attackers could steal data, alter a website’s contents or take control of it.
PHP works behind the scenes on websites, processing forms and retrieving information. It runs roughly 70% of websites whose server-side programming language can be identified, according to the tracker W3Techs, and it is a part of popular platforms including WordPress, Drupal and Joomla. The security firm Wiz said it had demonstrated successful attacks against installations of all three.
The flaws sit in PHP itself rather than in any one website, so a site can be at risk even when its own code has no bugs, Defense One reported. Palo Alto Networks’ Unit 42 said it had found more than 22.6 million internet-exposed systems that might be vulnerable. In some setups, an attack can happen before a website’s own code runs.
AI tools helped find the flaws
Security firm Calif first spotted one of the flaws in July with help from one of OpenAI’s advanced models, according to OpenAI. Wiz, owned by Google, independently found both vulnerabilities in August. Wiz researchers said that with frontier AI models and the right tools, one researcher finished in a week work that would previously have taken a team months. PHP’s maintainers led the development of the fixes.
Patch now or unplug
PHP’s developers released updates on Wednesday for supported versions of the software. The White House said the administration is working with federal agencies and artificial-intelligence companies to get the fix to users and to protect American networks and infrastructure.
The NSA’s Cybersecurity Collaboration Center told organizations that could not install the fix right away to take their systems offline. Cyber agencies across Europe gave the same advice, and governments in the Netherlands, Finland, France, Denmark and Germany took some sites offline as a precaution.
The disclosure was rushed after a post about the flaws appeared Tuesday morning on the technology forum Hacker News and was taken down, though screenshots spread online, according to the security firm Huntress. PHP’s developers then released the fixes a day ahead of plan. Website operators had little time to prepare.
Cloudflare said it had seen exploit attempts, including spikes of thousands of tries, as attackers changed tactics to get around protections. As of Wednesday afternoon, no successful break-ins had been confirmed, and CISA’s records showed no observed exploitation, though security specialists expect attempts to rise now that the flaws are public.
Reporting based on coverage by Defense One, CNN, USA Today and Insurance Business Magazine.
