The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently confirmed that attackers are actively exploiting a pair of severe security vulnerabilities in widely used PHP web software. In response to this threat, CISA issued an urgent directive to U.S. civilian federal agencies to patch their systems within the next three days.
This urgent warning came less than a week after the creators of the PHP programming language, which has been with us for decades, released patches for the aforementioned flaws. These vulnerabilities allow attackers to remotely penetrate vulnerable systems over the internet without needing a username or password. Given that PHP software is reportedly used by approximately 70% of publicly accessible servers, this situation poses a significant risk to many websites and applications.
Although these flaws were classified as critical, meaning they could have very severe impacts if exploited, security researchers initially stated that developing a functional exploit to compromise systems was challenging, though not impossible. However, confirmed active real-world exploitation now places extraordinary pressure on organizations to promptly apply patches to prevent potential compromises, operational disruptions, and data breaches.
Got an idea for a website or app?
Let's talk it through — non-binding, with no pressure, and a concrete next step.
While CISA's statement did not provide details on who specifically is exploiting these flaws, its warning comes shortly after security researchers reported evidence of active exploitation of PHP vulnerabilities. The flaws, known as PHP2Shell, consist of vulnerabilities that remained undetected for many years. They were originally discovered two years ago, but the non-profit foundation maintaining the software then stated there was no practical way for attackers to exploit them, so they remained unpatched. This changed earlier this year when researchers from the security firm Calif discovered a method to exploit these two previously "dormant" vulnerabilities, with the assistance of artificial intelligence models.
These two PHP flaws are an example of many vulnerabilities that either had not yet been discovered or were considered lower priority for years, but now pose an increased risk due to advancements in artificial intelligence's ability to uncover and exploit weaknesses, including chaining multiple deficiencies. PHP is one of many older web technologies that help keep the internet and modern technologies running but have suffered from insufficient support and funding for years. This makes it difficult for open-source projects like PHP to pay for security audits that could uncover weaknesses earlier.