Hackers got a four-day head start on epic PHP2Shell vulnerability

AI introduction

PHP disclosed the PHP2Shell vulnerability, and hackers began exploiting it within four days of its discovery; researchers at Calif and Wiz found the flaws, and Wiz estimates PHP powers about 70% of websites worldwide. OpenAI said frontier AI discovered the vulnerabilities before attackers, and worked with PHP, Calif, and Wiz to verify them and develop patches; the NSA and the UK's NCSC advise taking systems offline if they cannot be patched immediately, and the White House said federal agencies are assessing the impact.

Why it matters

The report brings together statements from the NSA, NCSC, the White House, and Wiz, so readers can gauge the scope of the PHP vulnerability and official guidance on handling it.

Article · English

“These vulnerabilities often provide a direct path to the server’s file system or database,” the NSA said. “If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.”

Researchers at two US cybersecurity groups, Calif and Wiz, discovered the vulnerabilities. Alphabet-owned Wiz estimated that the compromised programming language powered about 70 percent of all websites in the world.

“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said on Wednesday. “To our knowledge, frontier AI found these vulnerabilities before attackers did.”

“It highlights how AI can uncover security flaws with Internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits,” the AI lab added.

OpenAI worked with PHP, Calif, and Wiz to verify the vulnerabilities and develop the patches.

The White House said federal agencies were assessing the potential impacts of the bugs on government systems and critical infrastructure.

PHP’s wide presence on the Internet is largely because WordPress, the most widely used website-building platform, is written primarily in PHP and relies on it to function.

The UK’s National Cyber Security Centre said the vulnerabilities could potentially allow a hacker to take control of a website’s server without needing a password or other login credentials. “The NCSC is encouraging UK organizations to take immediate action,” it said.