PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet

[ustaad]

The U.S. National Security Agency’s sent out an alarming warning on Wednesday that two critical holes had been found in PHP, with patches already issued by the PHP Foundation.

PHP is a server-side programming language so widely used for web applications that it powers roughly 70% of the websites on the internet; by some accounts, that’s more than 33 million sites. It is also used by popular content management systems like WordPress.

The NSA warned that these holes are so severe that if a website can’t be patched immediately, it should be pulled off the web until it can be. The holes allow attackers to infiltrate the server’s file system or a database that may be used by the web app.

Interestingly, these holes have been tucked away in all versions of PHP since version 5, which was released in 2004. Websites not running relatively current versions of PHP will have some updating work to do, as PHP 8.1 and older versions are no longer supported. The recommendation is to update the web server to the current version of PHP, which is 8.5.12.

So how did two such ubiquitous, decades-old flaws that affect nearly every website on the internet suddenly come to light? AI, naturally, particularly via OpenAI and Google’s Wiz.

Security testing company Calif was engaged in OpenAI’s “Patch the Planet” initiative to find flaws in open source software. Using GPT‑5.6 Sol, it found one of the flaws, OpenAI disclosed in a blog post. Separately, the Wiz team also used AI, namely its Wiz Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol to find multiple vulnerabilities in PHP.

Both OpenAI and Wiz followed responsible security research practices and worked with PHP on patches before publicly disclosing the flaws. Then they all worked together to flesh out what they found, and test the patches, drawing in a host of others to help.

Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel. (While WordPress sites use PHP, WordPress has issued a statement saying that the flaw isn’t WordPress specific, and sites running its CMS must patch their servers and work with their web-hosting companies to ensure their sites are protected.)

OpenAI says that these flaws were found by researchers before hackers discovered them. So there were no reports of exploits in the wild. This is also in part because, before AI, these flaws were too hard for hackers to exploit. “With AI this is no longer a barrier. LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts,” Wiz warned in its blog about the flaws.

In other words, this is the kind of security issue that was found and prevented because of AI, but is also a high risk only because of AI.

Now that the issue has been disclosed, hackers are fully in the know. The race is on for the internet to patch tens millions of websites before hackers can attack the unpatched ones. Hence the NSA’s guidance that if you can’t patch your PHP website right away, you’re better off pulling it offline until you can.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

 

[ustaad]

 

[Oscar]

This has been quite fun on all the infosec messages here and there

 

[ustaad]

theguardian.com

Flaw in PHP computer language leads to shutdown of websites around world​

Robert Booth, Aisha Down

6–7 minutes

---

Websites around the globe have gone dark after a serious vulnerability was found in a computer language used to build much of the world wide web.

Belgian, Dutch, Finnish, French and German sites were among those that governments took down temporarily as they scrambled to patch the critical weakness in PHP, a language used by almost 70% of websites.

The vulnerability in the programming language, which became public on Tuesday, sparked warnings from national security agencies in Washington and London. It means millions of websites will need to be fixed. One internet infrastructure expert said Russian state actors or organised criminals could exploit the flaw to carry out cyber-attacks.

WordPress, one of the most common website systems, uses PHP, as does Wikipedia, the messaging software Slack and – at least historically – much of Facebook. The Wikimedia Foundation said it had taken down several systems on Wednesday as a precautionary measure until they could be patched.

The race to fix huge PHP flaw at the heart of the internet - The Latest
The organisation behind the language issued a patch on Wednesday after researchers testing cyberdefences discovered the flaw. The US National Security Agency told all organisations using PHP to take their systems offline if they were unable to patch them immediately. It said the vulnerability could “provide a direct path to the server’s file system or database”.

The UK’s National Cyber Security Centre gave similar advice and told organisations to check for “backdoors installed by an attacker”.

Because a fix is now public and AI tools are able to reverse engineer the bug with little effort, experts said they were bracing for a wave of intrusions as hackers ⁠jumped to get ahead of the updates.

AI was powering a “race to exploit”, said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black. He said the next step was the “mass compromise of every vulnerable web server on the internet”.

Prof Alan Woodward, a cybersecurity expert at Surrey University, said: “It was very surprising and troubling because of the extent to which PHP was used around the world. PHP issued a patch very quickly. The big thing is for everyone using it to get that in to make sure their systems are safe.

“The troubling part is there is going to be a long tail of websites who may not be maintained as well and they are going to remain vulnerable, which means we may see weeks and months of ongoing attacks. For the big juicy targets, I hope to goodness they are being patched quickly.”

Woodward said there was a window of opportunity for bad actors. “There is this race and some people unfortunately don’t even know they are in the race.”

OpenAI said it led a coalition of researchers that discovered the flaw and claimed “frontier AI” had been key. The researcher who found the weakness, however, said they used models available to the public.

Cybersecurity company Calif said in a blog post it found the flaws with the help of a large language model on 1 August and had been working on a fix ever since. Alphabet-owned cybersecurity company Wiz said in a blog post that it too had discovered it with the help of Wiz Atlas, its autonomous AI vulnerability research tool, as well as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.

The vulnerabilities remained hidden ‌in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to take advantage of, Wiz’s post said.

skip past newsletter promotion
after newsletter promotion

In a blog post late on Wednesday, Amazon security chief CJ Moses said its security team detected an attempt to exploit the vulnerabilities against one of its decoy “honeypot” systems on 17 October, four days before public disclosure.

The attempt on the system came from an anonymous internet address, suggesting the activity was conducted by a threat actor, Moses said, adding that it was unclear how the actor learned of the flaws while they were under embargo.

In a statement, the White House said it was made aware of the flaw on Friday.

In the UK, websites belonging to Edinburgh, Bristol and Oxford councils were taken offline. In France, local government websites including that of the Paris police prefecture went offline on Wednesday, as did in the Netherlands the national digital identity service, the website of the house of representatives and the site of the national cybersecurity centre.

The Australian Signals Directorate was temporarily affected by the outage overnight local time, with the national cyber defence agency noting other government websites may have been similarly affected.

Michał Woźniak, an internet infrastructure expert, said: “There’s going to be a lot of automatic exploitation of this.” The bug might allow cryptocurrency miners to exploit vulnerable servers at other people’s expense, he said.

He also said large crime organisations and Russian state actors could use the vulnerable sites as a launching pad from which to conduct distributed denial of service (DDoS) and other cyber-attacks.

The issue highlighted the poor state of internet infrastructure, Woźniak said, something that was being brought to light by advancing AI models but that had been a long-developing problem. The underlying vulnerabilities the researcher found were decades old.

“This is an environmental problem in an industry where there’s an incentive to move fast and make changes,” he said. “There’s an incentive to deploy a thing and then never update it and not think about maintenance.”

 

[ustaad]

PHP: What is it and why did it spark a global cyber security scramble?

AI uncovered long-hidden programming flaws, triggering a rare global cyber-security response.

www.bbc.com

1:21
How did AI discover the internet's massive cyber-security risk?
For more than a decade, serious flaws had gone undetected in the technology underpinning much of the internet.

It took AI to bring them to light and caused a global cyber-security alert.

The vulnerabilities lie within a programming language called PHP, which has been used internationally since the 2000s to build websites.

Governments and cyber-security agencies around the world are scrambling to contain the fallout of the discovery on Wednesday, and have urged website operators to install a new emergency fix or consider taking their platforms offline.

Cyber-security firm Wiz - one of the companies whose researchers uncovered the vulnerabilities - described the flaws as the "most severe" ever detected by AI.

OpenAI, whose technology was used to find the flaws, called the discovery "one of the most impactful security issues in recent memory".

Cyber-security issue hitting sites worldwide prompts 'millions' of hacking attempts​

What is PHP?​

Most people may not have heard of PHP, but they probably interact with it daily.

It stands for PHP: Hypertext Preprocessor, an open-source, back-end programming language which runs on a web server.

Developed in the early 1990s to help serve dynamic web pages and applications, PHP still powers lots of platforms today, including Wikipedia, online shops and WordPress – the system behind many websites.

When you visit a site, PHP is the code which collects data and effectively turns it into a page you can read.

It has also been used to write a number of tools for building or speeding up the creation of web apps, with Laravel, Symfony and Drupal among popular PHP frameworks.

According to cyber-security firm Wiz, which helped uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world's websites.

It is maintained by a non-profit called the PHP Foundation, composed of individuals and companies which depend on the language and aim to ensure its "long-term prosperity".

What is the vulnerability?​

A group of cyber-security researchers and organisations disclosed two vulnerabilities within PHP this week, which they warned could have the potential to upend sites across the internet.
Cyber firms Wiz and Calif said the flaws – coined "php2shell" - were inherent in the language itself, with versions of PHP released over the last decade affected.

Ryan Austin, a Calif researcher who helped uncover the security issues, told the BBC it was "the most serious vulnerability I've ever found".

Wiz wrote in a blog post about its findings that, under the right conditions, hackers could exploit the php2shell issue to take control of affected web servers and steal sensitive data - saying everything built on PHP was left exposed.

AI could also make such attacks easier and faster, Paul Spain, chief executive of Gorilla Cyber Security, told the BBC.

He estimated the flaw could affect "millions and millions" of websites.

Jill Slay, a cyber-security researcher at the University of Adelaide, said it would be "disastrous" if hackers or countries weaponised the flaw and seized private data from websites.

What websites have been affected?​

The alert has disrupted services globally, from gaming platforms to government portals and online forums.

That includes Wikimedia - the organisation behind the online encyclopaedia Wikipedia - which took down a number of its systems as a precautionary measure.

Sites and pages have been taken offline by the Finnish government, Edinburgh council and the BBC, with the Netherlands' cyber-security agency also pulling its website.

EPA
Websites like the University of Geneva's were taken offline on Wednesday
A number of Scotland's public organisations, including councils and health boards, have also taken their websites offline.

Some experts warn the vulnerability could leave poorly maintained websites, particularly those belonging to smaller organisations with limited security resources, at greater risk.

More attempts to exploit these flaws are likely in the coming weeks since the technical details are now being made public, cyber-security researcher Salil Kanhere from UNSW Sydney said.

What happened after the flaws were exposed?​

The PHP Foundation rolled out patches on Wednesday to fix the vulnerabilities that had been lurking in their software for years.
"All PHP users are strongly encouraged to update immediately," the company said.

Authorities and security organisations around the world have echoed those warnings to website operators to secure their platforms.

The US National Security Agency told all organisations that use PHP to take their systems offline if they were unable to patch them immediately, adding that the flaw could provide a "direct path" to exploit a system's database.

"These risks are serious enough to require immediate patching across United States Government departments and agencies," the agency said.

The UK's National Cyber Security Centre gave similar advice and told organisations to check for "backdoors installed by an attacker".

Its counterparts in the EU, Singapore and Australia have also issued similar alerts.

Japanese Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP.

Bloomberg via Getty Images
Japan's Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP
"We have an urgent request for everyone to take action tonight," Takaichi wrote on X.

"If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk," she said.

Tech companies have also sought to quickly secure their systems.

E-commerce giant Amazon said it was targeted in multiple attempts days before the public disclosure of the PHP issue, but its websites were operating as normal.

Matthew Prince, the boss of internet infrastructure firm Cloudflare, also said it had seen "thousands" of attempts to exploit the PHP vulnerabilities across its network in the 10 hours before it was publicly announced.

"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now," he wrote on X.

How was AI involved?​

Researchers at Calif and Wiz who located the vulnerabilities used advanced AI tools which can analyse code and find flaws much faster than humans or older systems.
"Modern software is incredibly complex, and some vulnerabilities can remain undetected for years," Kanhere said.

"The underlying bugs weren't new; what changed was our ability to find them," Kanhere said.

Details of the discovery leaked online this week, forcing the PHP platform's developers to rush out its announcement of the security flaw and its huge scale.

The incident "highlights how AI can uncover security flaws" but also how it can "help attackers rapidly develop offensive tools and exploits," OpenAI said in a blog post.

The ChatGPT-maker said it had released a program to check if the PHP platform is secure.

"Many of these flaws stem from the way software were built in the past, which were built for functionality and not with security in mind," said Ryan Ko, at the University of Queensland's Cyber Research Centre.

What does it mean for you?​

The issue affects back-end website and web development processes that will be invisible to many users - meaning most people won't need to take any action.
But small businesses with sites, including those built using WordPress, may be wondering how to protect themselves.

Those who own websites or manage infrastructure running PHP have been urged to secure their websites by updating to the latest version.

Ethical hacker Ken Munro, who has spent years finding security flaws in computer systems, says installing the fixes - known as patching - is "a bit like running a Windows update".

If a hosting company or web developer manages your website, contact them and ask whether the PHP security fixes have been applied - something that must be applied to PHP itself and cannot be resolved by updating WordPress or its plugins.

If you look after your website yourself, Munro says "it is your own responsibility to make sure fixes are applied".

The UK's National Cyber Security Centre recommends considering temporarily taking sites offline if updates or temporary protections cannot be applied quickly enough.

The US National Security Agency has also urged "heightened awareness" in the coming weeks, telling people to closely monitor updates from software vendors.

"Vigilance in applying patches related to those systems is paramount," it said.
And while the onus lies mainly on website operators, users should stay alert for any security advice issued by affected services, such as requests to change passwords, Kanhere said.

He warned people to be alert to any phishing messages exploiting the publicity around the incident too.