Critical PHP Flaws Spur Global Patch Effort, Temporary Shutdowns

A rush to update websites and protect against vulnerabilities in a widely used programming language continued into its second day, with researchers warning that hackers have attempted to exploit the weaknesses.

Disruption caused by the security issues began Wednesday after researchers disclosed that they had found two critical flaws in PHP that could potentially expose organizations using it in websites and software platforms to cyberattacks.

More than 30 government services in the UK remained offline Thursday while security updates are applied, Elizabeth Lloyd, the UK minister for space, cyber and regulatory reform, said in a statement Thursday to the House of Lords. “We are working very carefully with departments to restore the services safely and securely following that remediation activity.”

Telecommunications operator Orange said on Thursday that it was suspending access to some of its websites and applications while it deployed security patches for the vulnerabilities, according to a statement.

PHP is one of the web’s most widely deployed technologies, powering millions of websites and underpinning up to 70% of the internet. Any weakness could therefore cascade through the internet’s software supply chain, potentially exposing online services to data theft, malware and breaches. Taking sites offline means attackers can’t reach and exploit a flaw while it’s being fixed.

How PHP Flaw Put Millions of Websites, Apps at Risk: Explainer

The developers responsible for maintaining PHP released software updates to patch the flaws on Wednesday, urging users to adopt those changes immediately.

Governments and organizations in countries including Austria, the Netherlands, Finland, France, Denmark, Australia, Canada, Germany, Belgium were among those to pull websites offline on Wednesday as they worked to implement fixes. The White House was also engaged with U.S. federal agencies and critical infrastructure firms on the issue.

In Japan, several banks and airlines took services offline. Mizuho Financial Group Inc.’s bank and security arms halted services and said they were taking emergency steps to improve security. Regional lender Shizuoka Bank suspended its website and app, while Mitsubishi UFJ Financial Group Inc. companies halted some online services.

Hackers already attempted to exploit PHP’s security holes in the days before the flaws were made public, according to researchers at Amazon.com Inc.

In a report published on Wednesday, Amazon said hacking attempts took place by an unknown “threat actor” who had somehow obtained information about the vulnerabilities prior to the public release of details about them.

Amazon’s threat intelligence unit said it identified hackers attempting to exploit a network of sensors it uses to track and analyze cybercriminal activity. The company later detected several other exploitation attempts.

Matthew Prince, chief executive officer at the cybersecurity company Cloudflare, said in a post on X that they had identified thousands of attempts to exploit the PHP vulnerabilities 10 hours before they were publicly announced. Within two hours of the announcement, Prince said, the hacking attempts were in the hundreds of thousands and later increased into the millions. It’s not clear how many of those attempted intrusions were ultimately successful in stealing data or otherwise compromising an organization’s computers.

The window between security holes becoming known and organizations implementing a patch was critical and required swift action by any organization affected, said Matt Hull, vice president of cyber intelligence and response at NCC Group.

“There is a real possibility that vulnerable systems could already have been compromised, including the creation of backdoors,” said Hull. “The potential impact is serious.”

The U.S. Office of the National Cyber Director was coordinating with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and others to remediate the issue.

U.S. cybersecurity company Palo Alto Networks said that it had identified more than 22.6 million “exposed instances” — such as a server, database, or application — containing the PHP vulnerabilities. Lee Klarich, Palo Alto’s chief product and technology officer, said the scale of the exposure was “massive.”

PHP is “everywhere” and quietly powers websites that run using systems such as WordPress, Drupal, Joomla and Magento, according to the cybersecurity firm Huntress. PHP is also present “under the hood” of software, even though the software may not advertise that it is using it, Huntress said.

Researchers at Alphabet Inc.-owned cybersecurity company Wiz discovered the flaws with the help of several artificial intelligence tools. The company said it had collaborated with OpenAI and the cybersecurity firm Calif on the work. Wiz’s report estimated that the PHP vulnerability affected around 70% of the internet and had existed undetected for more than a decade, but AI tools helped quickly identify a fix for them.

“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” it said.

Top photo: Ethernet cables Photographer: Jason Alden/Bloomberg.