Hackers got a four-day head start on an epic PHP vulnerability, dubbed PHP2Shell, according to reports. The National Security Agency warned that the flaws often provide a direct path to a server's file system or database. "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated," the NSA said.
Researchers at two US cybersecurity groups, Calif and Wiz, discovered the vulnerabilities. Alphabet-owned Wiz estimated that the compromised programming language powers about 70 percent of all websites in the world. "Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory," Open AI said on Wednesday. "To our knowledge, frontier AI found these vulnerabilities before attackers did."
"It highlights how AI can uncover security flaws with Internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits," the AI lab added. Open AI worked with PHP, Calif, and Wiz to verify the vulnerabilities and develop the patches. The White House said federal agencies were assessing the potential impacts of the bugs on government systems and critical infrastructure.
PHP's wide presence on the Internet is largely because WordPress, the most widely used website-building platform, is written primarily in PHP and relies on it to function. The UK's National Cyber Security Centre said the vulnerabilities could allow a hacker to take control of a website's server without needing a password or other login credentials. "The NCSC is encouraging UK organizations to take immediate action," it said.
Source: Ars Technica · Summarized by HeadlinesBriefing