Organizations urged to patch critical PHP flaws as websites temporarily go offline
publishers 27articles 31first reported 20 Oct, 19:27 UTCdeveloping since 21 Oct · 10 editions
Cybersecurity agencies urged organizations to install emergency PHP updates after researchers identified two critical vulnerabilities that could allow attackers to execute code remotely without authentication.
The flaws, dubbed “PHP2Shell,” were rated 9.2 out of 10 under the CVSS v4.0 system, according to Taiwan’s Administration for Cybersecurity. PHP is widely used in websites and services, including systems built on WordPress, Drupal, Joomla and Magento.
Researchers at Google-owned cybersecurity firm Wiz discovered the vulnerabilities in August using AI models alongside human analysis, according to Scroll.in and a Bloomberg Opinion commentary published by CNA. Another cybersecurity firm, Calif, separately found the flaws while working with OpenAI through its Patch the Planet initiative, CNA reported. PHP developers confirmed the issue in late September and released emergency patches on Wednesday after information about the vulnerabilities surfaced publicly, according to Scroll.in.
The US National Security Agency advised organizations to patch immediately or take affected systems offline. Government bodies in the United Kingdom, Europe, Japan, Australia and Taiwan also issued warnings. Several European government and local-authority websites, parts of the BBC website and services operated by the Port of Rotterdam were temporarily taken offline while updates were applied.
Taiwan’s cybersecurity agency also urged organizations to update Node.js and Go. It said Node.js patches addressed 10 vulnerabilities, while new Go versions blocked certificates affected by exposed private keys. Go applications must be recompiled and redeployed for that protection to take effect.
HOW THIS STORY WAS MADE
Written from 8 articles, 3 with the publisher's own text; 8 independent newsrooms once syndicated copies count as one; this version written 72 h after the record first saw the story; the editor kept it as written.
- Publishers
- 27
- Source articles
- 31
- Given to the writer
- 8, 3 with the article's own text
- Independent newsrooms
- 8
- This version written
- 72 h after the record first saw the story
- Second model (editor)
- kept as written
- Publication gate
- passed
- Human review
- none
WHAT THE EDITOR DID
The second model checked the writer's draft against the same sources and published it as written.
Written by a language model from the sources above, then checked by a second model that may only cut, attribute or correct. How it works →