Cybersecurity researchers in California have used an advanced artificial intelligence model to identify the PHP2Shell vulnerability, a longstanding flaw that could expose up to 70% of the world’s websites and web applications.
The weakness affects PHP, a programming language used across the internet, including by government agencies and social media platforms. Researchers said the flaw had existed for at least a decade before they found a way to turn it into a potentially serious security threat.
PHP is so widely embedded in online services that organisations may be using it without knowing it, according to Robert McMillan, a Wall Street Journal reporter who first reported on the issue.
“There are a lot of sites that I don’t think even know that they have a problem and they may find out the hard way,” he said.
The discovery has highlighted the growing role of artificial intelligence in both finding and exploiting weaknesses in computer systems. Ethical hackers used the technology to carry out the complex, time-consuming work needed to understand how the bug could be used to run unauthorised software.
Mr McMillan said people had known for some time that “something weird was going on”, but had been unable to develop an exploit that went beyond causing a computer to crash.
Andrés Guerrero-Saade, vice president of intelligence and security research at SentinelOne, said AI was speeding up the work of vulnerability researchers while also giving cybercriminals the ability to act more quickly.
“That whole gap between the patch being available and attackers getting to exploit that before anybody patches, that’s the whole game essentially,” he said.
PHP security fixes released
The PHP Foundation said it had released fixes for the vulnerabilities, together with instructions for updating affected systems. It urged anyone running PHP to update immediately.
The FBI’s cyber threat division said the flaws could allow criminals to interfere with websites and apps by remotely inserting malware into PHP source code, potentially compromising sensitive data and networks.
Voldemaras Kadys, head of security at Mediatech, said two critical flaws could allow hackers to take control of vulnerable website servers, steal customer information, alter content, install malware or take sites offline.
The FBI is encouraging organisations unable to patch their websites immediately to take them offline temporarily.
Microsoft chief executive Satya Nadella said he had not seen a similar development “in a long, long time”, adding that it underlined the need for stronger security measures in software.
For consumers, visiting a PHP-powered website does not necessarily mean their own device will be compromised. However, an attacker who exploits a vulnerable website could potentially access information held in an account, such as a name, email address, physical address or date of birth.
Mr Kadys said users did not need to stop browsing or shopping online, but should remain alert to suspicious messages because it was not known what information might have been stolen, or from which websites.
