Urgent security fix issued for code vital to estimated 70% of all websites

PHP may not be a household name, but the programming language, released over 30 years ago, powers a large share of websites and web applications. Nearly 70% of the internet is estimated to use PHP, including WordPress, which is used for more than 40% of websites.

Now the PHP development team is urging users to update immediately after fixing two critical vulnerabilities, rated 9.2 out of 10 in terms of danger, that if exploited could allow attackers to take over internet servers.

On Wednesday, the PHP development team released updates that "fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately,” according to the official PHP website.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday said it "strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP," noting that while it "has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched."

Likewise, the FBI Cyber Division urged all potentially affected organizations to "immediately update affected PHP installations."

"If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated," the FBI said.

The U.K. government's National Cyber Security Centre also encouraged organizations "to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated.”

Open AI posted Wednesday morning that their AI models helped researchers discover the PHP flaws.

"Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure," the post said, in part. "Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact."

The company added that they believe their AI model identified the problems before hackers could exploit the vulnerabilities.

OpenAI has come under increased scrutiny in recent months following disclosures that their AI models attacked numerous websites, including U.S. government websites and those of rival AI companies.

Before the PHP fix was released, the cybersecurity firm watchTowr said Tuesday it believed the vulnerabilities "could let attackers run their own code on affected servers" and that "organizations running PHP in production should prepare to update quickly once an official fix is released.”

The PHP team said updating the code is the only complete fix. While it lists temporary measures to address the vulnerabilities, such as adjusting memory and upload settings, it notes that those measures only reduce exposure and do not make a server safe from potential exploitation.