Millions of Websites at Risk Due to Critical PHP Vulnerabilities

Two critical vulnerabilities have been discovered in PHP, a programming language that powers up to 70% of the world's websites, potentially putting millions of users' personal data at risk. The flaws, disclosed by PHP developers on Wednesday, could enable hackers to gain unauthorized control of affected servers.

Successful exploitation of these vulnerabilities could allow malicious actors to steal sensitive information stored on servers or repurpose compromised websites to launch attacks against their visitors. Website operators are now in a race to apply the necessary patches before attackers can leverage artificial intelligence to analyze the updates and develop exploits for unpatched systems. Thai Duong, CEO of the security firm Calif, which identified the vulnerabilities, warned that AI could accelerate the discovery and deployment of exploits, stating, "All hell will break loose."

Lukasz Olejnik, a visiting senior research fellow at King's College London, noted that AI-assisted hacking campaigns have become more prevalent, potentially amplifying the threat. "The scale is huge," Olejnik said. "And with AI, exploitation may happen instantly, on a large scale."

Understanding the Vulnerabilities

The security company Huntress highlighted the pervasive nature of PHP, noting its role in powering popular content management systems such as WordPress, Drupal, Joomla, and Magento, as well as numerous shared hosting platforms and control panels. Both disclosed flaws relate to how PHP manages server memory. One vulnerability allows the software to mishandle data when encountering memory issues, while the other permits the reuse of memory that has already been released.

The team responsible for maintaining PHP reportedly released patches to address these issues on Wednesday morning ET. In response to the discovered vulnerabilities, several websites temporarily went offline on Wednesday, including the bookmarking site Pinboard and parts of Wikipedia.

Official Recommendations and Early Exploitation Signs

European and British authorities have advised websites to disconnect from public networks until fixes can be implemented. CERT-EU, the European Union’s technical cybersecurity advisory body, recommended that "Organizations should consider isolating internet-facing applications from public networks until a fix is available.”

In Japan, numerous sites, ranging from daycare centers to news outlets, have voluntarily taken themselves offline. While the full extent of the attacks is still unclear, the cybersecurity platform Patchstack has reported "reports of active exploitation."

Cloudflare, a provider of internet infrastructure and security services, has also observed early signs of attacks. The company's chief technology officer stated on X that "We are seeing early attacks emerging and are updating mitigations as new vectors show up."

PHP functions by assembling website content on a server and delivering it to a user's browser. Security experts emphasize that the widespread reliance on this underlying software means that attackers could potentially target millions of servers by scanning the internet for vulnerable versions of PHP, rather than attempting individual compromises.