Global Cyber-Security Alert Issued Over PHP Vulnerabilities

Governments and major companies, including Amazon, are working to identify and patch potential exposure in their online services following the discovery of critical vulnerabilities in the PHP programming language. The flaws, which underpin a significant portion of the world's websites, were identified with the aid of AI, prompting urgent calls for action from cybersecurity agencies worldwide.

The UK government stated it is actively working to identify and address any potential exposure in its online services. The UK's National Cyber Security Centre (NCSC), alongside counterparts in the EU and Australia, has urged organizations using PHP to apply the necessary fixes. The NCSC advised that if immediate remediation is not possible, systems should be taken offline until the vulnerabilities can be fully mitigated.

Amazon reported that it experienced exploitation attempts, including a "PHP2Shell exploitation attempt" on October 17, before a warning embargo was lifted. The company's security chief, CJ Moses, noted that attempts originating from an anonymous internet address suggest the activity was conducted by a "threat actor." Further attacks on Amazon occurred on October 21, with variations in anonymization infrastructure suggesting multiple actors were involved. These incidents took place after details of the flaw were leaked on social media but before the official warning was publicly released.

Moses highlighted that the involvement of AI means "more actors can act within hours or even minutes once technical details of a vulnerability are disclosed." Anna-Maria Arabia, CEO of the Australian Council on AI Strategy, commented that this incident demonstrates how rapidly AI is altering the cybersecurity landscape, with vulnerability exposure times shrinking from months to days. She warned that such threats are likely to become more frequent as AI technology advances.

The PHP flaws reportedly went undetected for at least a decade. Cyber-security firm Wiz has estimated that approximately 70% of the internet may be affected by these vulnerabilities.

In response to the alert, some entities took immediate precautionary measures. The Dutch cybersecurity agency temporarily went offline, Finland's government shut down its public web services, and Wikipedia removed parts of its website. These actions aligned with advice from governments, including the U.S., to take websites offline if immediate fixes were not feasible. The PHP Foundation released software patches to address the flaws on October 21.

The U.S. National Security Agency (NSA) noted that these vulnerabilities can offer a direct pathway to a server's file system or database, potentially enabling attackers to steal sensitive data, disrupt services, or infiltrate networks more deeply. The NSA clarified that these are fundamental flaws within PHP itself, rather than issues with hosted applications or their configurations.

OpenAI described the discovery as "one of the most impactful security issues in recent memory."