Newly disclosed vulnerabilities in PHP, a widely used web programming language, prompted security warnings on October 21 from cyber agencies in the US, the UK, the European Union, and Australia, as well as Japan’s prime minister. AI-assisted researchers uncovered bugs that could let attackers take over affected web servers and steal data.

The issue, known as PHP2Shell, led to emergency patches for two vulnerabilities that could enable remote code execution.

Researchers at Calif and Wiz, a US-based cloud security company, discovered the flaws using OpenAI technology. OpenAI also released a tool to help developers check PHP installations for vulnerabilities.

PHP developers issued patches. The US National Security Agency advised organizations that could not patch immediately to take affected systems offline.

The UK’s National Cyber Security Centre urged organizations to check for attacker-installed backdoors. Downstream vendors and hosting providers were still rolling out patched builds.

PHP remains widely used across the web. The response has included temporary shutdowns of some websites and systems operated by organizations such as Wikimedia, the Finnish government, and Edinburgh City Council.

🔗 Source: BBC