Critical Vulnerability Discovered in PHP Programming Language

Government websites across Europe and other parts of the globe have suddenly gone dark as a critical vulnerability in a widely used programming language has been discovered.

The issue lies in PHP, a code that powers many online services including blogs, e-commerce sites, and government portals. Most users are not directly affected, but it's a fundamental component of websites, building pages behind the scenes before they reach visitors' browsers.

Developers of the language have issued an urgent update, urging all users to install the new fixes immediately. This comes after details about the vulnerabilities were leaked online on Tuesday, forcing PHP developers to rush out patches.

Experts are bracing for a surge in hacking attempts as malicious actors try to exploit the weaknesses before users can install the necessary updates.

A critical coding flaw has been discovered in the widely used PHP programming language, allowing hackers to run malicious code on websites and potentially exposing sensitive information.

The vulnerability arises from how PHP handles fatal errors, such as running out of memory, which can be exploited by attackers to read passwords and other credentials stored on a server's memory. This means even simple websites using affected versions of PHP could be vulnerable to hacking attempts. According to cloud security company Wiz, the problem is inherent in PHP itself.

The two flaws, dubbed PHP2Shell, were independently discovered by cybersecurity companies Calif and Wiz using artificial intelligence. Calif reported the first flaw on August 11, while Wiz reported the second on August 24. Both vulnerabilities have been rated critical, with a severity score of 9.2 out of 10.

The coding flaws remained undetected in PHP's codebase for over a decade and would be extremely difficult for human hackers to exploit without sophisticated tools and expertise. Calif and Wiz worked closely with the PHP team and OpenAI before disclosing the vulnerabilities publicly, allowing for swift action to mitigate their impact.

The discovery of the critical vulnerability has raised concerns about its potential impact on the global digital infrastructure.

Security experts are still trying to determine how a hacker managed to learn about the flaws before they were publicly disclosed. According to Amazon security chief CJ Moses, his team detected an attempt to exploit the vulnerabilities four days before the public disclosure, which suggests that there may have been some prior knowledge of the issue.

The PHP language has been in use since the early 1990s and is widely used for web development. It underpins many popular content management systems such as WordPress, Drupal, Joomla, and Magento, making it a critical component of the public-facing web.

As a result, any vulnerability in PHP can have significant knock-on effects, particularly given that more than 70 percent of websites globally rely on the language.

The severity of the situation is underscored by Cullen's warning about the potential for widespread disruption to shared digital infrastructure.

The development of artificial intelligence (AI) is creating a paradox in cybersecurity. While AI has improved at detecting and fixing bugs, it also has become more adept at exploiting them, making the internet both safer and riskier.

In the Netherlands, several high-profile websites went dark as a precautionary measure due to the vulnerabilities. These included government portals, hospital websites, and even the website of the Port of Rotterdam. The country's national football association, KNVB, also took its website offline.

The Dutch Prime Minister has been keeping a close eye on the situation. This move is part of a broader trend in which organizations are taking proactive steps to mitigate potential risks.

In Finland, state IT services provider Valtori temporarily shut down government public network services as a precautionary measure. Meanwhile, France's Ministry of the Interior put all its websites into preventive maintenance mode.

Belgium's Federal Public Service Foreign Affairs, Foreign Trade and Development Cooperation initially took its websites offline after reports of cyberattacks exploiting the PHP vulnerabilities.

South Korea's government has escalated its cybersecurity alert level in response to the PHP vulnerability, triggering emergency response measures to mitigate potential damage. The move aims to protect a significant portion of the country's private sector, including 28,000 companies that have registered chief information security officers.

The operator of Wikipedia temporarily took down several systems for patching, while the Internet Archive also went offline briefly to address the issue. In addition, critical infrastructure operators, web-hosting firms, and data centres were informed about the potential risks and advised on necessary precautions.