Critical PHP vulnerabilities send organizations scrambling to secure their systems

Two critical vulnerabilities affecting up to 70% of the world's websites were disclosed by PHP maintainers, leading to urgent calls for organizations to secure their systems. The exploits, known as PHP2Shell, enable hackers to deploy malicious code on vulnerable servers in a matter of seconds and potentially compromise databases and launch cyberattacks against visitors.

Cybersecurity agencies, including the National Security Agency, have advised organizations to shut down affected systems while implementing updates. Some municipalities, schools and private companies have complied with the advice. Content delivery network providers Cloudflare and Fastly have observed active attacks exploiting the bugs.

The PHP2Shell vulnerabilities arise from PHP's handling of excess data and global state information, allowing malicious code to access information before it's deleted. Google and cybersecurity firm Wiz have made additional discoveries about the issue. An industry group formed to address PHP2Shell has developed over 10,000 lines of code and fixes for the vulnerabilities.

However, some organizations still run outdated PHP versions that no longer receive standard security updates, making it difficult to implement patches. Experts advise security teams to identify exposed systems, prioritize internet-facing systems, and collaborate with vendors on upgrade paths or supported fixes.