What is PHP, and how bad is the computer language flaw causing website shutdowns globally?

An estimated 70% of websites use the open-source language. What is the identified vulnerability in it?

PHP is an open-source scripting language that is over 30 years old and used in much of the internet. Content management systems and publishing template systems such as Wordpress are built on PHP.

Websites across the world have been taken offline in the past day as governments and businesses work to patch newly discovered vulnerabilities in PHP, a programming language that underpins much of the internet. 

The exposed flaw would have allowed hackers to carry out cyberattacks. 

What were the vulnerabilities, and why did they affect so many sites?

What is PHP?

PHP is an open-source scripting language that is over 30 years old and used in much of the internet. Content management systems and publishing template systems such as WordPress are built on PHP.

An estimated 70% of websites use PHP, with millions of sites potentially affected by the vulnerabilities. Wikipedia and Facebook are among those.

Drupal, which is reportedly used as a web platform for many governments around the world, is another service affected by the PHP vulnerabilities. In Australia, for example, 391 government websites use a Drupal-run platform called GovCMS.

What is the vulnerability?

According to the PHP Foundation, the not-for-profit which maintains PHP code, the issues “sit in parts of PHP that nearly every request touches: memory management and error handling”.

The two vulnerabilities were dubbed a PHP2Shell exploitation by security vendor Hadrian.

The vulnerabilities work by corrupting the memory in a website through a request that can then be used to launch an attack, and could “provide a direct path to the server’s file system or database,” according to the US National Security Agency.

How was it discovered?

Historically, researchers and cybersecurity experts would test systems for vulnerabilities themselves and patch the issues when they are discovered – or patch when one system is attacked and a vulnerability is identified.

Artificial intelligence has now sped up this process, as AI can be thrown at systems to identify potential issues that might not have been spotted by a human, and can do so in a much shorter time frame.

The PHP Foundation said it has worked with Anthropic’s frontier model to scan its code, and had PHP put into OpenAI’s Patch the Planet program, which discovered the issue at the same time as a researcher, Ryan A, in mid-August.

The disclosure of the vulnerabilities had been embargoed until 22 October, to give websites time to fix it. But according to the PHP Foundation, it discovered the two vulnerabilities had begun circulating on forums and social media on Tuesday, and so brought forward the disclosure.

How bad is it?

Bad. As the PHP Foundation has said, the issues sit in parts of PHP that nearly every request touches: “Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions.” Coupled with the sheer number of sites that rely on PHP, that makes it a massive issue that should be fixed as soon as possible.

Now the flaw is out in the wild; Hadrian said it was seeing “exploitation happening at scale”.

How long will it take to fix?

Patches are already available, and the reason a number of websites went down in the past day was that people were working to patch their systems immediately. A number of the websites returned quickly.

Security firms have recommended patching immediately, and where it cannot be done immediately, that systems should be taken offline.

“Shutting down a service for a few hours costs far less than a compromised server,” Hadrian said.

However, it will depend on businesses and governments being aware they need to patch, and doing so quickly.

“The immediate challenge is not simply installing a patch, but finding and managing every instance where PHP is running,” said Don Smith, vice-president of threat intelligence at cybersecurity firm Sophos Counter Threat Unit.

Sigi Goode, a professor of information systems at the Australian National University, said the sites that went down to fix it were not the problem.

“The bigger concern is the websites that are not down today. Users should be wary of these, as they are clear targets.” 

Did someone leak the vulnerability and break embargo?

It’s unclear whether the vulnerability was leaked ahead of time. A number of security firms did break the embargo after the leak, according to the PHP Foundation, but Amazon Threat Intelligence said in a blog post it had identified a PHP2Shell exploitation attempt dating to four days before the public disclosure.

“While the vulnerability was under embargo, the targeting of a honeypot from an anonymised IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” it said.

On the day the embargo was due to lift, but before it had lifted, Amazon also identified “multiple proof of concept exploits for the vulnerability”. These are non-harmful demonstrations that a vulnerability exists, without actually using that vulnerability to launch an attack – akin to testing a door to see if it has a faulty lock.

Is AI making the internet more vulnerable to these sorts of issues?

With AI, it’s much easier to find vulnerabilities now. AI agents can now identify issues that would have taken humans months or years to find, and they’re also finding ones people weren’t aware of.

It’s why there have been more updates issued for software on phones or computers lately.

Part of the problem is that – with the exception of the most frontline models – AI is very easy for everyone to get their hands on and use. It leads to something of a race between people trying to protect their systems, and hackers looking to take advantage of AI-discovered vulnerabilities.

“Threat actors move fast, especially with the help of AI, and this will likely be a priority target for them over the coming hours and days so it is crucial organisations monitor PHP and web-server processes for unusual processes, command execution or other signs that an attacker may already have gained a foothold,” Smith said.

Some on social media have also pointed to a prescient cartoon by Randall Munroe, who is behind the web comic XKCD, about the reliance of modern infrastructure on projects maintained by small groups or one person.

The PHP Foundation operates on financial contributions and maintains the language with only 13 full-time and part-time engineers, compared to the billions invested in developing AI.

-The Guardian