AI Discovers Critical PHP Security Flaws That Could Put Millions of Websites at Risk

A serious cybersecurity warning has been issued after researchers discovered critical security flaws in PHP, a programming language used by millions of websites. The vulnerabilities, known as php2shell, could allow attackers to take control of affected web servers and access sensitive information if the systems are not properly protected.

The discovery has raised concerns worldwide, with governments, technology companies, and cybersecurity agencies urging website owners to check their systems and install security updates immediately.

PHP is a programming language that runs on web servers and helps websites display content and handle information. It is widely used by platforms such as WordPress, Wikipedia, online stores, and many other websites.

According to cybersecurity firm Wiz, PHP powers around 70% of websites worldwide. This wide use means that security problems in PHP could affect a large number of online services.

Researchers from cybersecurity companies Wiz and Calif identified two serious vulnerabilities that had reportedly remained undetected for more than a decade. The flaws received a severity rating of 9.2 out of 10. Researchers warned that attackers could use them to access databases and steal private information under certain conditions.

Advanced AI tools developed by OpenAI helped researchers examine code and identify weaknesses that had gone unnoticed for years. Experts say AI can analyse complex software faster than traditional methods, making it easier to discover hidden security problems. However, the same technology could also help cybercriminals develop attacks more quickly. Internet infrastructure company Cloudflare reported a sharp rise in attempts to exploit the PHP flaws after details became public. As of no successful attacks had been reported, but experts warned that the risk could continue as more attackers learn about the vulnerabilities.

The PHP Foundation released security updates to fix the flaws and urged users to update immediately. Website owners should install the latest available PHP security fixes or contact their hosting provider or web developer to confirm that the updates have been applied. Updating WordPress or its plugins alone may not fix vulnerabilities in PHP itself. If the necessary security fixes cannot be applied quickly, website operators may need to consider temporarily taking their sites offline.

For everyday users, no immediate action may be needed. However, they should watch for official security notices and remain alert to phishing messages related to the incident.

Information referenced in this article is from BBC