What to know about the PHP bug affecting 70% of the world’s websites

Cybersecurity researchers used an advanced OpenAI artificial intelligence model to identify a longstanding internet vulnerability before hackers could exploit it.

That security weakness affects a programming language called PHP, short for “Personal Home Page,” which powers up to 70% of the world’s websites and web applications, including those used by government agencies and social media platforms such as Facebook.

“PHP is everywhere — not everyone who is using it even knows that they’re using it because it’s this ubiquitous technology that’s been baked into the internet for years and years,” Wall Street Journal reporter Robert McMillan, who first reported on the PHP security issue, told CBS News. “There are a lot of sites that I don’t think even know that they have a problem and they may find out the hard way.”

The discovery of a major internet weakness also highlights the battle between cybersecurity experts and hackers over how to use AI to spot potential holes in organizations’ technology systems. In this case, security researchers were the first to uncover the bug, which had existed for at least a decade. 

“People knew something weird was going on. But no one could really find a way to write an exploit — of turning a bug that might cause a computer to crash into something really bad that would allow somebody to run software that they weren’t supposed to be able to run on a computer,” McMillan said.

The bug, dubbed PHP2Shell, was identified by so-called ethical hackers in California using advanced AI models, which proved critical in spotting the vulnerability. 

“Their sense was this was so complicated, it was kind of tedious to find,” he said. “It would take a lot of work for a human to be banging away for months and months to figure out what was going on. But an AI can do that menial, complex, long-term task much more quickly.”

Racing to patch 

Andrés Guerrero-Saade, vice president of intelligence and security research at SentinelOne, told CBS News that the incident illustrates “how AI is accelerating the ability of vulnerability researchers” while also boosting bad actors’ capacity to exploit security flaws.

 The time between a vulnerability being detected and a fix being released is crucial for cybersecurity experts, he added.

“That whole gap between the patch being available and attackers getting to exploit that before anybody patches, that’s the whole game essentially,” Guerrero-Saade said. 

Yet that vital window of time has been shortened by AI, allowing cybercriminals to move much faster today than in the past.

“We are just out here trying to get folks to patch on time,” he said. 

The PHP Foundation, which includes tech developers who work on securing the programming language, said on Wednesday that it had released fixes for the vulnerabilities, along with instructions on how to update systems.

“If you run PHP, it is imperative that you update now. The announcement on php.net contains and references technical details on the vulnerabilities, attack vectors, and instructions on how to update on which systems,” the group said. 

In a post on X, the FBI’s cyber threat division acknowledged the vulnerabilities, which it said expose websites and apps to interference from cybercriminals who can remotely insert malware into PHP’s source code, “potentially compromising sensitive data and networks.”

“Two critical security flaws were discovered in PHP that could allow hackers to take control of vulnerable website servers and potentially steal customer information, change website content, install malware or take the website completely offline. The potential impact of these vulnerabilities may be huge, as most websites run on PHP,” Voldemaras Kadys, head of security at Mediatech, said in a statement to CBS News.

The FBI is encouraging any organization that can’t immediately patch its sites to temporarily take them offline. 

What should consumers know?

Consumers’ personal information could be vulnerable if they have an account with an online store or booking platform whose site is not secure. 

“For regular internet users, simply visiting a PHP website doesn’t necessarily mean their device will be compromised,” Kadys explained. “The risk is that attackers may exploit a website that holds their personal information. For example, if a user has an account with an online shop, attackers may be able to hack that website through this PHP vulnerability and extract the information the user has stored there, such as their email address, physical address, name and date of birth.”

But just because a site is vulnerable doesn’t guarantee that a breach has occurred or will occur. 

“There’s no reason to stop browsing or shopping online, but users should still be extra cautious about suspicious messages because we don’t know what kind of data hackers may have stolen through this vulnerability, and from which websites,” he added.