Urgent Security Fix Released for Widely Used PHP Web Language

The PHP development team has released urgent security updates to address two critical vulnerabilities that could enable attackers to gain control of internet servers. The programming language, which is over 30 years old and powers an estimated 70% of all websites, including over 40% built on WordPress, received fixes on Wednesday.

These vulnerabilities, rated 9.2 out of 10 in severity, allow for unauthenticated remote code execution. The PHP development team strongly encourages all users to update their systems immediately, noting that the released updates are the only complete solution. While temporary measures exist, such as adjusting memory and upload settings, these only reduce exposure and do not fully mitigate the risk of exploitation.

The U.K. government's National Cyber Security Centre is advising organizations to prepare for immediate updates of PHP systems. They recommend considering taking affected systems offline until they can be fully remediated if immediate updates are not feasible.

OpenAI announced that its AI models were instrumental in identifying these flaws before they could be exploited by malicious actors. The company stated that a coalition of researchers and security providers worked with them to prepare fixes and protections prior to public disclosure. OpenAI described this vulnerability as one of the most impactful in recent memory and a significant milestone in AI's capability to detect security bugs with widespread internet implications.

Before the official fix was released, cybersecurity firm watchTowr indicated that the vulnerabilities could allow attackers to run their own code on affected servers and advised organizations to prepare for quick updates upon the release of an official patch.