Governments Pull Websites Offline Over Critical PHP Flaws
Government agencies in Europe, Asia and elsewhere temporarily took some of their websites offline on Wednesday, October 21, after two critical vulnerabilities were disclosed in PHP, a programming language used by more than 70 percent of websites, Al Jazeera reported.
The flaws, dubbed PHP2Shell, let an attacker remotely run commands on a server using outdated PHP code without a password or a legitimate account. The nonprofit PHP Foundation, which supports the volunteer-maintained language, said they were among the most severe flaws it had encountered and urged website administrators to update their code immediately. PHP's developers released patches the same day, the BBC reported.
Rare Warning From the NSA
The US National Security Agency issued a rare public warning, advising organisations to take websites offline if they could not update them immediately. "These risks are serious enough to require immediate patching across United States Government departments and agencies," the agency said, according to the BBC. Britain's National Cyber Security Centre gave similar advice, and agencies in the EU, Singapore and Australia issued alerts.
Japanese Prime Minister Sanae Takaichi urged people to check whether their public websites ran on PHP. "If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk," she wrote on X.
Sites Taken Offline
In Germany, the federal digital ministry said it had pulled some sites as a precaution, while France's Interior Ministry switched off the websites of local administrative offices. Authorities in Belgium, the Netherlands, Finland and the Czech Republic said they had shut websites to apply the patch, Al Jazeera reported.
Wikimedia, the organisation behind Wikipedia, took down a number of its systems as a precaution, the BBC reported. Edinburgh council, the BBC itself and several Scottish councils and health boards also took websites offline.
Found With the Help of AI
The first flaw was reported on August 11 by researchers at Calif who were working with OpenAI; Alphabet-owned security firm Wiz reported the second on August 24. Wiz said the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history". The firm said the underlying flaws had existed for decades, but proving they could be exploited required a chain of steps "at the edge of what human researchers could practically achieve".
Disclosure had been planned for October 22, but CVE details and a proof-of-concept exploit leaked early, and the PHP Foundation brought the release forward by a day, according to The Hacker News. Amazon's threat intelligence team said it detected an attempt to exploit PHP2Shell against its MadPot honeypot service on October 17, The Hacker News reported.
Comparisons With Heartbleed and Log4Shell
Some analysts have warned the incident could prove comparable in its implications to the 2014 Heartbleed bug, BusinessKorea reported. Dark Reading compared PHP2Shell with the Log4Shell flaw in Log4j 2 nearly five years ago, which also required the security industry to work together to patch a major flaw in a popular open-source project.
What Website Owners and Users Can Do
Website owners are being urged to move to the latest version of PHP. More attempts to exploit the flaws are likely in the coming weeks now that technical details are public, Salil Kanhere, a cyber-security researcher at UNSW Sydney, told the BBC. He said users should watch for security advice from affected services, such as requests to change passwords, and be wary of phishing messages that exploit the publicity around the incident.