NSA Warns of Critical PHP Vulnerabilities Prompting Website Precautions

The IT industry is on high alert following the discovery of two severe vulnerabilities in PHP, a scripting language that powers millions of websites. This warning was issued after an anonymous user reported that these vulnerabilities could be exploited to execute unauthorized code, allowing hackers to manipulate websites and servers that utilize PHP. Cybersecurity provider Wiz Security described these vulnerabilities as among the most serious ever found in PHP, noting that the problematic code has existed for over a decade.

The PHP Foundation has confirmed that both vulnerabilities can lead to unauthenticated remote code execution, urging all PHP users to update their systems immediately. Notably, an AI model from OpenAI played a role in uncovering these flaws. The PHP Foundation has released patches, but they are only available for PHP versions 8.2 and above, which poses a challenge since the vulnerabilities also affect older versions, including those as far back as PHP 5.4, according to the UK’s National Cyber Security Center (NCSC-UK).

There is significant concern that hackers may quickly develop exploits to take advantage of these vulnerabilities before website operators can implement fixes. PHP is integral to generating dynamic web content and managing backend application logic, which makes the potential for exploitation particularly alarming. The NSA has emphasized that these vulnerabilities can provide direct access to a server's file system or database, recommending that organizations take their systems offline if they cannot apply updates immediately.

In Europe, CERT-EU has echoed this advice, suggesting that organizations isolate internet-facing applications from public networks until a resolution is found. PHP is estimated to power nearly 70% of websites that utilize the language, with around 24 million sites relying on it. Major platforms like Wikipedia and WordPress are among the significant users of PHP, with Wikipedia actively working on updates and advising users to do the same.

Industry Response to PHP Vulnerabilities

The industry response has been swift, with major cloud service providers like Google Cloud, Amazon Web Services, and Microsoft coordinating efforts to patch the vulnerabilities. OpenAI has also disclosed that its model, GPT-5.6 Sol, assisted cybersecurity firm Calif in identifying the threat. Researchers at Wiz Security independently reported the vulnerabilities, utilizing various AI models during their investigation.

Despite the proactive measures, both OpenAI and Wiz Security caution that AI models could also facilitate the exploitation of these vulnerabilities. The PHP Foundation has indicated that there is already a demonstrated exploit that can trigger an attack through unauthenticated requests before any application code is executed.

Final Assessment

Cloudflare has implemented new firewalls for its customers in response to the emerging threats, but CTO Dane Knecht has warned that early attacks are already being observed, prompting ongoing updates to their mitigation strategies. In a precautionary move, the National Cyber Security Center in the Netherlands has taken its site offline.

For organizations using older PHP versions, the PHP Foundation advises contacting vendors for backported fixes or upgrading to a supported version. However, the consensus among the researchers is clear: upgrading PHP is the only comprehensive solution to mitigate these vulnerabilities.