Hackers could exploit weaknesses in a widely used programming language for websites, online platforms and other technology services to steal user information and cause other problems, cybersecurity researchers warn.
The programming language PHP, short for “Personal Home Page”, powers up to 70% of the websites and web applications in the world, including those used by government agencies, social media platforms such as Facebook and sites including Wikipedia.
The bug, called PHP2Shell, can target two security flaws in PHP, according to Voldemaras Kadys, head of security at Mediatech. These weaknesses could allow cybercriminals to seize control of unprotected website servers, install malware, pilfer customer data and even take down sites entirely.
“The potential impact of these vulnerabilities can be huge because most websites run on PHP,” he said in an email.
The flaws in PHP were discovered when security researchers used an OpenAI artificial intelligence model to identify the problem, Wall Street Journal reporter Robert McMillan, who first reported on the PHP security issue, told CBS News.
“There are many sites that I don’t think even know they have a problem, and they can find out the hard way.”
What should consumers know?
Consumers’ personal information could be vulnerable if they have an account with an online store or booking platform whose site uses PHP and is exposed to the bug.
“For regular Internet users, simply visiting a PHP website does not necessarily mean their device is compromised,” Kadys explains. “The risk is that attackers exploit a website that holds their personal information. For example, if a user has an account with an online shop, attackers can hack that website through this PHP vulnerability and extract the information that the user has stored there, such as their email address, physical address, name and date of birth.”
But just because a site is vulnerable does not guarantee that a breach has or will occur.
“There is no reason to stop browsing or shopping online, but users should still be extra careful about suspicious messages, as we do not know what data hackers have stolen through this vulnerability, and from which websites,” he added.
Racing hackers
Andrés Guerrero-Saade, vice president of intelligence and security research at SentinelOne, told CBS News that the incident illustrates “how AI is accelerating the ability of vulnerability researchers” while also enabling bad actors to exploit security flaws.
The time between a vulnerability being detected and a fix being released is crucial for cybersecurity experts, he added. But that vital time window has been shortened by AI, allowing cybercriminals to move much faster today than in the past.
“That whole gap between the patch being available and the attackers exploiting that before anybody patches, that’s basically the whole game,” Guerrero-Saade said.
In a post on X, the FBI’s Cyber Threats Division encouraged any organization that cannot patch their sites immediately to take them offline temporarily.
The PHP Foundation, which includes tech developers working to secure the programming language, said Wednesday it released fixes for the vulnerabilities, along with instructions on how to update systems.
“If you are running PHP, it is imperative that you update now. The announcement on php.net includes and references technical details about vulnerabilities, attack vectors and instructions on how to update on which systems,” the group said.
The discovery of the flaws highlights the battle between security professionals and hackers in using AI to spot potential holes in organizations’ technology systems. In this case, security researchers were the first to discover the bug, which has existed for at least a decade, McMillan noted.
“People knew something weird was going on. But no one could really find a way to write an exploit — to turn a bug that could cause a computer to crash into something really bad that would allow someone to run software they weren’t supposed to run on a computer,” he said.