PHP rushes out fixes for two critical flaws found with AI
PHP put out emergency fixes for two serious flaws that could let attackers take over web servers, BleepingComputer and The Register reported. Researchers used AI tools to find the bugs. Cloudflare said it was already seeing early attacks, BleepingComputer and The Verge reported.
The team behind PHP, a language that runs much of the web, released emergency fixes Wednesday for two critical flaws, according to BleepingComputer and The Register. The bugs, called PHP2Shell, could let attackers run their own code on web servers without logging in, BleepingComputer reported.
Researchers at Calif, OpenAI and Wiz found the flaws, BleepingComputer and The Register reported. All three companies said they used AI models to find them, The Register said.
The bugs affect PHP setups that serve web pages, BleepingComputer reported. Admins should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as soon as possible, it said. Older versions no longer get regular updates.
PHP rated the flaws 9.2 out of 10 for severity, The Verge reported. BleepingComputer said PHP powers 75% to 80% of all websites. The Verge said every WordPress site is at risk because WordPress runs on PHP, citing the security firm Wordfence. WordPress says it powers more than 40% of the web, The Verge reported.
Before the fixes came out, Cloudflare said it was seeing early attacks, BleepingComputer and The Verge reported. "We are seeing early attacks emerging," Cloudflare's chief technology officer, Dane Knecht, said, according to The Verge.
The UK's National Cyber Security Centre urged groups to update right away or take systems offline until they are fixed, BleepingComputer reported.
PHP had planned to release the fixes Thursday but moved them up a day, The Register reported. Details about the bugs began to leak online Tuesday, PHP developers said, according to The Register.
"Distributors were still packaging the fix, so releasing immediately would have left many users without an easy way to update," the PHP Foundation said, according to The Register.
What we know: Fixes are out, and site owners are urged to install them now.
What we don't: How many sites have been attacked before patching.
Where outlets agree BleepingComputer and The Register report that PHP released emergency patches for two critical PHP2Shell flaws found by researchers at Calif, OpenAI and Wiz.
Where they differ BleepingComputer and The Verge don't conflict on the facts, though BleepingComputer says PHP powers 75% to 80% of all websites while The Verge points to WordPress, which it says powers more than 40% of the web.