What to know about the PHP bug affecting 70% of the world’s websites

Hackers could exploit weaknesses in a widely used programming language for websites, online platforms and other technology services to steal users’ information and cause other problems, cybersecurity researchers warn. 

The programming language PHP, short for “Personal Home Page,” powers up to 70% of the world’s websites and web applications, including those used by government agencies, social media platforms such as Facebook and sites including Wikipedia. 

The bug, dubbed PHP2Shell, can target two security flaws in PHP,  according to Voldemaras Kadys, head of security at Mediatech. Those weaknesses could enable cybercriminals to seize control of unprotected website servers, install malware, pilfer customer data and even take sites down completely.

“The potential impact of these vulnerabilities may be huge, as most websites run on PHP,” he said in an email. 

The flaws in PHP were discovered when security researchers used an OpenAI artificial intelligence model to identify the problem, Wall Street Journal reporter Robert McMillan, who first reported on the PHP security issue, told CBS News.

“There are a lot of sites that I don’t think even know that they have a problem, and they may find out the hard way.”

What should consumers know?

Consumers’ personal information could be vulnerable if they have an account with an online store or booking platform whose site uses PHP and is exposed to the bug. 

“For regular internet users, simply visiting a PHP website doesn’t necessarily mean their device will be compromised,” Kadys explained. “The risk is that attackers may exploit a website that holds their personal information. For example, if a user has an account with an online shop, attackers may be able to hack that website through this PHP vulnerability and extract the information the user has stored there, such as their email address, physical address, name and date of birth.”

But just because a site is vulnerable doesn’t guarantee that a breach has occurred or will occur. 

“There’s no reason to stop browsing or shopping online, but users should still be extra cautious about suspicious messages because we don’t know what kind of data hackers may have stolen through this vulnerability, and from which websites,” he added. 

Racing hackers

Andrés Guerrero-Saade, vice president of intelligence and security research at SentinelOne, told CBS News that the incident illustrates “how AI is accelerating the ability of vulnerability researchers” while also boosting bad actors’ capacity to exploit security flaws.

The time between a vulnerability being detected and a fix being released is crucial for cybersecurity experts, he added. Yet that vital window of time has been shortened by AI, allowing cybercriminals to move much faster today than in the past.

“That whole gap between the patch being available and attackers getting to exploit that before anybody patches, that’s the whole game essentially,” Guerrero-Saade said. 

In a post on X, the FBI’s cyber threat division encouraged any organization that can’t immediately patch its sites to temporarily take them offline. 

The PHP Foundation, which includes tech developers who work on securing the programming language, said on Wednesday that it had released fixes for the vulnerabilities, along with instructions on how to update systems.

“If you run PHP, it is imperative that you update now. The announcement on php.net contains and references technical details on the vulnerabilities, attack vectors, and instructions on how to update on which systems,” the group said. 

The discovery of the flaws highlights the battle between security professionals and hackers in using AI to spot potential holes in organizations’ technology systems. In this case, security researchers were the first to uncover the bug, which had existed for at least a decade, McMillan noted.

“People knew something weird was going on. But no one could really find a way to write an exploit — of turning a bug that might cause a computer to crash into something really bad that would allow somebody to run software that they weren’t supposed to be able to run on a computer,” he said.