PHP flaw: website owners told to patch now or take sites offline

Website operators around the world spent this week rushing to fix newly disclosed security flaws in PHP, the open source programming language that powers a large share of the web. The warning was blunt: apply the patch immediately, or take the site offline until it can be secured.

Governments and several heavily visited websites briefly went dark to deal with the problem. Attackers, meanwhile, moved quickly to exploit the weakness before servers could be updated.

Found by human researchers

The vulnerabilities were identified by human researchers taking part in Hack the Planet, an initiative run by OpenAI and Wiz, the security company now owned by Google. The researchers did not use artificial intelligence to discover the bugs, but they relied on it to exploit them.

The flaw is understood to have sat unnoticed in PHP for decades. Because the language underpins content management systems such as WordPress and Drupal, the exposure is vast, with estimates putting it at around 70% of websites, or tens of millions of sites.

Fixing it required a public disclosure. With a flaw this deep in the internet’s foundations, there was no practical way to quietly alert everyone responsible for an affected website, so the patch and the warning had to go out together.

Millions of attack attempts

The rollout drew criticism. Some details appear to have surfaced before the agreed embargo was lifted, triggering a scramble among hackers, and the tone of the post OpenAI published about the discovery was also faulted by some observers.

Cloudflare said attempted attacks using the exploit, referred to as PHP2Shell, had climbed into the millions.

Amazon said in a blog post that its decoy network, known as a honeypot, had recorded attempts to exploit the vulnerability before it was publicly announced.

Concerns over lost websites

The episode has renewed debate about how much of the internet now rests on open source code kept running by small teams or volunteers. Large companies such as Amazon have the resources to detect and repel such attacks, but many smaller sites do not.

There is also concern that organisations, local groups and public bodies may choose to shut older websites down rather than patch them. That would leave broken links across the web and could make archived material, including small pieces of online history, permanently inaccessible.