The PHP development team has issued an urgent security update to address two critical vulnerabilities in the programming language, which powers an estimated 70% of all websites. The flaws, rated 9.2 out of 10 in terms of danger, could allow attackers to take over internet servers if exploited. The team released updates on Wednesday, urging users to update immediately to prevent potential remote code execution.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI Cyber Division have also strongly urged organizations to patch the vulnerabilities immediately. The U.K. government's National Cyber Security Centre echoed this advice, recommending that organizations take systems offline if an immediate update is not feasible.
OpenAI played a significant role in discovering the flaws, with their AI models helping researchers identify the vulnerabilities before they could be exploited. The company described the bugs as one of the most impactful vulnerabilities in recent memory, marking a new phase where AI can detect security bugs with internet-scale impact.
The PHP Foundation acknowledged a delay in addressing the vulnerabilities, attributing it to structural failures and the need for experts to balance multiple responsibilities. The vulnerabilities began circulating online, prompting the PHP development team to accelerate their planned announcement and fix.
Amazon Threat Intelligence detected a hacking attempt on October 17, suggesting that threat actors may have known about the vulnerabilities before the public announcement. The company warned that attackers are moving faster than in the past, urging organizations to apply critical fixes within hours rather than days or weeks.