PHP Flaws Trigger Global Cybersecurity Emergency — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- PHP powers 70% of the world's websites, including Wikipedia and WordPress, and has been found to contain critical flaws that could allow hackers to take control of web servers.
- Wiz and Calif researchers discovered the vulnerabilities, dubbed 'php2shell', using AI tools, and described them as the most severe ever detected by artificial intelligence.
- The PHP Foundation released emergency patches on Wednesday, urging all users to update immediately to prevent exploitation of the decade-old flaws.
- US National Security Agency advised organizations to take PHP-based systems offline if they can't be patched immediately, warning of a 'direct path' to database breaches.
- Wikimedia, Finnish government, Edinburgh council, and BBC took websites offline as a precaution, while the Netherlands' cyber-security agency also suspended its site.
- Amazon reported being targeted in multiple attack attempts before the public disclosure, though its platforms remained operational.
- OpenAI called the discovery 'one of the most impactful security issues in recent memory' and released a tool to check if PHP systems are secure.
Why it matters: Hundreds of millions of websites built on PHP are now in a race against exploitation, with smaller organizations at higher risk due to limited resources; failure to patch immediately exposes sensitive data to takeover, and the speed of AI-driven attacks means delays cost more than ever.
Ask SkimNews
