Critical PHP Vulnerabilities Raise Global Cybersecurity Alarm
The discovery of critical security vulnerabilities in PHP, a programming language used by approximately 70% of websites worldwide, has raised concerns across the global cybersecurity community. Identified with the assistance of artificial intelligence (AI), the flaws could potentially allow attacker
A critical security flaw discovered in PHP, a programming language powering about 70% of global websites, has sparked alarm in the cybersecurity community. AI-assisted researchers identified the flaws, which could enable attackers to execute malicious code on vulnerable servers without authentication. This incident, similar in severity to the 2014 Heartbleed vulnerability, has prompted emergency security updates from the PHP development team.
The vulnerabilities, labeled PHP2Shell, earned a top severity score of 9.2 in the Common Vulnerability Scoring System (CVSS), classifying them as Critical. PHP is fundamental to many website functions, including user authentication and payment processing, and is utilized by popular content management systems like WordPress. South Korea, in particular, faces substantial risk, with an estimated 110,000 servers potentially vulnerable, according to AhnLab's analysis.
Other affected platforms include Gnuboard and Rhymix, which are based on PHP, intensifying concerns about the extent of the vulnerabilities. The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) have issued security guidance to major companies and are assessing emergency patching support for smaller enterprises.
AI played a crucial role in uncovering these flaws, which had remained unaddressed for over a decade. This incident has also raised concerns about AI's potential to both bolster defensive security measures and facilitate malicious activities, such as vulnerability analysis and exploit development. In response, companies and government agencies worldwide have implemented precautionary measures, such as suspending certain website functions or taking affected government sites offline.
Reports of attempted attacks following a pre-emptive leak of vulnerability information have further heightened these concerns. Experts urge operators of PHP-based websites to promptly apply the latest security updates. The PHP Foundation has highlighted the broader challenges of an open-source ecosystem reliant on a small group of volunteer contributors, stressing the need for sustained corporate investment and additional engineering resources to ensure long-term security maintenance.
Written by urgent.news from BusinessKorea's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
