23:01Machine-translated from Azerbaijani by AIRead in Azerbaijani
Two Critical PHP Vulnerabilities Could Allow Servers to Be Taken Over
The U.S. National Security Agency issued an urgent warning on October 21 about 2 critical security vulnerabilities found in the PHP programming language. An attacker exploiting the vulnerabilities, dubbed “PHP2SHELL,” could access files and the database on a server or even take control of the server. PHP runs on approximately 70 percent of websites, or more than 33 million sites. Popular content management systems such as WordPress also use PHP.
The PHP Foundation has already released security patches. Website administrators are advised to update their servers to PHP 8.5.12. PHP 8.1 and older versions are no longer supported. Therefore, updating them may require additional work. If the patch cannot be installed immediately, the agency recommends temporarily taking the site offline. One of the vulnerabilities was discovered by the security company Calif, which participated in OpenAI’s Patch the Planet program. The GPT‑5.6 Sol model was used for this purpose. Wiz also independently discovered both vulnerabilities. During its research, the company used the Wiz Atlas, Gemini 4 Argon, and GPT‑5.6 Sol tools. Before disclosing the information, the researchers tested the patches together with the PHP team. Cloudflare, AWS, Microsoft, Akamai, Fastly, Imperva, Vercel, and Automattic also joined the effort. The work was completed after 2 months of preparation, and the vulnerabilities were scheduled to be disclosed on October 22. However, because details were published prematurely, the PHP team released the patches on October 21. There are conflicting reports about how long the vulnerabilities had existed. OpenAI executive Greg Brockman said the problem had persisted for 14 years. According to another study, however, the vulnerability had remained in every version since PHP 5 was released in 2004. Although a less serious variant of the problem was discovered in 2024, it was not considered a major threat at the time. Calif discovered a more dangerous variant in August. The OpenAI team separately discovered a more complete form of the problem in September. So far, there is no information indicating that attackers have exploited these vulnerabilities. Nevertheless, artificial intelligence tools could adapt exploit code more quickly to different PHP versions and server configurations. Wikipedia was inaccessible for a period on October 21. The Wikimedia Foundation confirmed that the outage was related to the PHP vulnerabilities. As a precaution, the organization also shut down other systems until the patches were installed. Problems were also reported with other services, including Asana, Duolingo, Bitbucket, Moodle, GOG, and Internet Archive. However, it has not been confirmed that these incidents were related to PHP. Japan’s prime minister also urged website owners to immediately install the patch released at 18:00 on October 21. OpenAI announced that it would allocate 1 billion dollars (1.7 billion manat) to enable organizations protecting critical services to use security tools. The company also released a separate tool that administrators can use to check which PHP version they are running. The White House and U.S. cybersecurity agencies joined the response efforts. OpenAI is also proposing a new system to provide earlier warnings about vulnerabilities. This is because serious problems have also been discovered in other widely used technologies, including Node.js.
The PHP Foundation has already released security patches. Website administrators are advised to update their servers to PHP 8.5.12. PHP 8.1 and older versions are no longer supported. Therefore, updating them may require additional work. If the patch cannot be installed immediately, the agency recommends temporarily taking the site offline. One of the vulnerabilities was discovered by the security company Calif, which participated in OpenAI’s Patch the Planet program. The GPT‑5.6 Sol model was used for this purpose. Wiz also independently discovered both vulnerabilities. During its research, the company used the Wiz Atlas, Gemini 4 Argon, and GPT‑5.6 Sol tools. Before disclosing the information, the researchers tested the patches together with the PHP team. Cloudflare, AWS, Microsoft, Akamai, Fastly, Imperva, Vercel, and Automattic also joined the effort. The work was completed after 2 months of preparation, and the vulnerabilities were scheduled to be disclosed on October 22. However, because details were published prematurely, the PHP team released the patches on October 21. There are conflicting reports about how long the vulnerabilities had existed. OpenAI executive Greg Brockman said the problem had persisted for 14 years. According to another study, however, the vulnerability had remained in every version since PHP 5 was released in 2004. Although a less serious variant of the problem was discovered in 2024, it was not considered a major threat at the time. Calif discovered a more dangerous variant in August. The OpenAI team separately discovered a more complete form of the problem in September. So far, there is no information indicating that attackers have exploited these vulnerabilities. Nevertheless, artificial intelligence tools could adapt exploit code more quickly to different PHP versions and server configurations. Wikipedia was inaccessible for a period on October 21. The Wikimedia Foundation confirmed that the outage was related to the PHP vulnerabilities. As a precaution, the organization also shut down other systems until the patches were installed. Problems were also reported with other services, including Asana, Duolingo, Bitbucket, Moodle, GOG, and Internet Archive. However, it has not been confirmed that these incidents were related to PHP. Japan’s prime minister also urged website owners to immediately install the patch released at 18:00 on October 21. OpenAI announced that it would allocate 1 billion dollars (1.7 billion manat) to enable organizations protecting critical services to use security tools. The company also released a separate tool that administrators can use to check which PHP version they are running. The White House and U.S. cybersecurity agencies joined the response efforts. OpenAI is also proposing a new system to provide earlier warnings about vulnerabilities. This is because serious problems have also been discovered in other widely used technologies, including Node.js.