The leak and disclosure of a pair of vulnerabilities in the PHP scripting language has caused headaches around the world, with websites taken offline for patching and malicious actors actively scanning for sites and servers that remain vulnerable.
Just the patching alone has caused considerable disruptions, with even the Australian Signals Directorate taking its website offline so that the issue could be addressed.
The impact, says Ismael Valenzuela, Arctic Wolf’s Vice President, Labs, Threat Research and Intelligence, remains potentially “enormous”.
“PHP powers roughly 70 per cent of websites where the server-side programming language is known. This puts a significant portion of the internet's business and commercial infrastructure at potential risk and demands immediate attention,” Valenzuela told Cyber Daily.
“While that doesn't mean all these websites are vulnerable, it illustrates just how widely used this technology is and why organisations need to assess their exposure quickly.”
However, while the risk remains real, the nature of how these vulnerabilities were discovered signals a step change in the disclosure process.
“One of the most important lessons from PHP2Shell is that AI is changing what we consider exploitable,” Valenzuela added.
“Some of these vulnerabilities existed for more than a decade, and they are particularly concerning because they sit inside the PHP runtime, beneath applications like WordPress, WooCommerce, Magento, Drupal, and other widely used web platforms. What changed wasn’t the underlying code, but the ability to find those weaknesses and turn them into working exploits.
“AI is making sophisticated security research more accessible, which is great news for defenders, but we should assume attackers will benefit from those same capabilities. We need to stop thinking about vulnerability management as simply identifying a flaw, assigning a severity score, and waiting for a patch. The real question is how quickly we can identify exposure, understand the risk, and prevent a single compromised system from becoming a much larger incident.”
The initial leak of the vulnerabilities, prior to their patching and full disclosure, also may have given threat actors a head start on exploitation, said Jiří Kohout, Cyber Risk & Security Strategist – CEE, at Check Point Software Technologies.
“Patches are now available, and installing them should be a top priority. However, simply updating WordPress or its plugins is not enough; PHP must be updated directly on the server,” Kohout told Cyber Daily.
“Patches have already been released in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Versions 8.1 and older remain vulnerable unless the patch is backported. Website owners should therefore contact their administrator or hosting provider as soon as possible to verify that the patch has been applied. Priority should be given to servers accessible from the Internet.
“After updating, it is important to restart the relevant services and verify that they are indeed running the patched version. Operators using external hosting should confirm with their provider that the patch has been applied. If a vulnerable service cannot be secured quickly, it is advisable to restrict its accessibility or, if necessary, temporarily take it offline.”
According to Kohout, administrators also need to consider the possibility that an attack has already occurred.
“Installing the patch alone will not remove any damage or malicious code that attackers may have left on the server. Therefore, be vigilant if you detect unusual web service outages, new PHP files, unusual requests, suspicious command execution, or server connections to unknown addresses,” Kohout added.
“Security systems that block dangerous requests and detect suspicious server behaviour can also reduce the risk. It is necessary to continuously update security measures and enable attack blocking. Limiting communication between servers and the rest of the corporate network can then mitigate the consequences of a potential breach.
“These measures help buy time, but they are no substitute for updating PHP itself.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
