Websites around the world have been taken offline as a precaution after AI was used to discover two critical vulnerabilities in PHP, a programming language that powers much of the internet. 

Fixes were released yesterday, and Ireland’s National Cyber Security Centre, its UK counterpart and the EU’s cybersecurity team (CERT-EU) have all urged organisations to install the update.

The All Ireland Science Media Centre asked experts to comment.

Dr Deepak Padmanabhan, Senior Lecturer, School of Electronics, Electrical Engineering and Computer Science, Queen’s University Belfast, comments: 

PHP is a scripting language that is employed by websites. When you send a request to the website, such as querying a national-level data service about demographic make-up or voting statistics of a region, it would usually be a PHP script that queries the internal database and fetches the information, which then gets formatted in ways that it would appear in the response web page.

“The current security vulnerability is one which could potentially, under technically rare circumstances, allow somebody to run a program through remote access, one that is called remote code execution. In other words, malicious actors could exploit this to run *their own* program on the servers, leading to myriad outcomes. It could involve querying the underlying database in ways that are unintended or undesirable, or to run a deliberately computationally intensive program so the server is rendered incapable of routine function.

“This remains an extremely rare possibility and was intended to be fixed through some program updates. However, the information about this vulnerability leaked earlier than the roll out of updates, triggering the panic we are witnessing. The updates, as far as one can reliably learn, would close the vulnerability – thus, this is only a transient issue that exists until fixes get applied widely.

“Some news outlets have cited claims that Russian state actors or organised criminals could exploit the flaw to carry out cyber-attacks. However, at the time of this writing, there is not an iota of evidence to suggest that such threats are imminent.” 

Declaration of interests: “I have no interests to declare”

Dr. Domhnall Carlin, School of Electronics, Electrical Engineering and Computer Science, Queen’s University Belfast, comments:

“PHP is a programming language from the mid-1990s, which runs behind an estimated 70% of websites and web applications.  It also drives many systems that allow users to build interactive websites, like WordPress, Drupal etc.  So, when a vulnerability is detected in the underlying programming language, the blast radius can be very broad. 

“Two critical vulnerabilities have recently been disclosed in PHP, now referred to as “php2shell”. These have been given a CVSS score of 9.2 out of a possible 10, meaning they are of critical severity.  They allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests – a huge attack surface across the globe. 

“The good news is that a fix is available.  However, updating can be a slow process because PHP is often buried several layers deep within the tech stack. Many organisations also lack a complete inventory of where vulnerable versions are running. Even when this is known, applying patches or updating PHP versions can also break custom code and plugins, so fixes need substantial testing, which sometimes results in downtime. Limited resources make this harder still and smaller sites may depend on hosting providers or developers to act on their behalf. 

“There seems to have been a huge co-ordination process behind the scenes to resolve this issue before it became public.  The remediation advice at https://www.php.net/ should be followed. If patching can’t happen immediately, the NCSC advises taking affected systems offline until they’re mitigated.” 

Declarations of interest: “nothing to declare”

John Ronan, Infrastructure Manager at Walton Institute, South East Technological University, comments:

What is PHP in simple terms?

“PHP used to stand for Personal Home Page, now it refers to the Hypertext Preprocessor, which is a scripting language that helps web developers make web pages more interactive. Developed in the early 1990s to help serve dynamic web pages and applications, PHP still powers lots of platforms today, including Wikipedia, online shops and WordPress – the system behind many websites. Some estimates put it at 70% of websites.”

How serious are these flaws, and what could an attacker do with them?

“There are two separate vulnerabilities. In both cases, due to different bugs, someone with no authorisation could run commands on the server.”

What should organisations and website owners do now?

“From huntress: Inventory every PHP install. Start with your web servers, and then go hunting for the less obvious locations: vendor appliances and Windows software that bundle php.exe or php-cgi.exe, control panels like cPanel and Plesk, and anything running WordPress, Drupal, Joomla, or Magento. Patch your systems as soon as updates are available.

“Identify any end-of-life PHP environments. If you’re running PHP 5, 7, or 8.0/8.1, you may not get a fix at all. Upgrade, take it off the internet, or put it behind a VPN or web application firewall (WAF) until you can. If you find something, isolate the server, and preserve web server and PHP logs. Look for webshells and new files in your web root, along with new cron jobs, scheduled tasks, and accounts.

If a fix is out, why might sites stay vulnerable?

“Systems could be so old, there is no viable way to patch them.”

What makes it slow or difficult for organisations to update?

“Not being fully aware of what systems are running in their organisation. (Shadow IT)”

Declarations of interest: none received