Critical PHP flaws prompt governments and businesses to take websites offline
publishers 67articles 87first reported 21 Oct, 02:12 UTCdeveloping since 21 Oct · 11 editions
Governments and businesses worldwide took websites and online services offline after two critical vulnerabilities were disclosed in PHP, a server-side programming language used by nearly 70% of websites whose underlying language is known.
The flaws, dubbed “PHP2Shell,” could allow an unauthenticated attacker to execute code remotely on a vulnerable server, potentially exposing data or enabling access to other resources. Researchers at Calif and Google’s Wiz used artificial-intelligence tools to help identify the vulnerabilities, which had reportedly existed for years.
The PHP Foundation released patches on Wednesday, October 21, about 24 hours earlier than planned after details leaked online. It urged operators to update immediately. The U.S. National Security Agency likewise advised organizations to patch affected systems or take them offline.
No successful breaches had been publicly confirmed by Thursday, according to UK officials and cybersecurity authorities. However, Amazon Threat Intelligence said its monitoring network detected an attempted exploit before the disclosure, while cybersecurity firm Tolmo said it developed a working exploit in less than a day.
In Britain, 32 government services were unavailable and four were partially unavailable, largely because of precautionary shutdowns, a minister said. Nepal also suspended thousands of government and banking websites, including Nepal Rastra Bank’s site and some digital services, while systems were patched and audited. Colombia’s cyber-response team identified 8,699 internet-facing services using PHP, though officials cautioned that the count did not establish that all were vulnerable.
HOW THIS STORY WAS MADE
Written from 8 articles, 6 with the publisher's own text; 8 independent newsrooms once syndicated copies count as one; this version written 114 h after the record first saw the story; the editor kept it as written.
- Publishers
- 67
- Source articles
- 87
- Given to the writer
- 8, 6 with the article's own text
- Independent newsrooms
- 8
- This version written
- 114 h after the record first saw the story
- Second model (editor)
- kept as written
- Publication gate
- passed
- Human review
- none
WHAT THE EDITOR DID
The second model checked the writer's draft against the same sources and published it as written.
Written by a language model from the sources above, then checked by a second model that may only cut, attribute or correct. How it works →