Critical PHP vulnerabilities force site owners to patch urgently or take sites offline
After long-undetected vulnerabilities were found in the open source programming language PHP, website owners were told to patch immediately or take their sites down. Human researchers found the flaws, though AI was used to exploit them.
An urgent warning went out this week: vulnerabilities have been discovered in PHP, an open source programming language, and website owners must patch them immediately. Those unable to update right away were advised to take their sites offline. The situation was discussed on TechCrunch's Equity podcast by journalists Kirsten Korosec, Sean O'Kane and Anthony Ha.
What was found
PHP is widely used to build websites, and content management systems including WordPress and Drupal rely on it. According to Korosec, it underpins roughly 70% of websites, meaning tens of millions. The vulnerability has reportedly existed in PHP for decades without being noticed.
It was initially thought that AI models had found the flaws, but this was later corrected: human researchers taking part in the Hack the Planet initiative, run by OpenAI and Wiz (a company now owned by Google), found them. They used AI to exploit the bug.
Fallout
O'Kane said some people rushed to exploit the flaws to break into websites. Governments took down sites, and popular sites went offline briefly to apply fixes. He added that some people got ahead of the disclosure embargo, setting off a race among hackers. Cloudflare CEO Matthew Prince reported millions of attempted attacks using PHP2Shell. Amazon, through a honeypot (decoy) network, saw exploitation attempts before the public announcement.
Concerns
Korosec noted that many smaller or government sites lack the attention Amazon can give, and she warned of link rot if owners shut sites down instead of patching them. The participants suggested this is only the start of a new phase in cybersecurity and wondered whether new startups or open source security tools would emerge.
