Science & TechCybersecurity
Governments pull websites offline as 'PHP2Shell' flaws expose the web's most common language
Two critical bugs in PHP, found with the help of AI and hidden in the code for more than a decade, have pushed ministries, ports and hospitals in Europe offline while administrators rush to install emergency fixes.
Key points
- The two PHP flaws, nicknamed PHP2Shell, each scored 9.2 out of 10 for severity.
- The US National Security Agency advised taking sites offline if they could not be patched at once.
- Amazon says it saw an exploit attempt on 17 October, before the flaws were made public.
Government departments across Europe have taken their websites offline after two critical flaws were found in PHP, the programming language behind a large share of the world’s websites, and details of the bugs leaked before every server could be fixed.
The vulnerabilities, nicknamed PHP2Shell, let an attacker run commands on a server running affected PHP code without a password or an account. Each scored 9.2 out of 10, the “critical” band. They had sat in the code for more than a decade and affect PHP 5.4 and every later version, according to the security firms Calif, Wiz and Cloudflare.
The US National Security Agency issued a rare public warning on Wednesday, advising organisations to take sites offline if they could not update them immediately. The PHP Foundation, the non-profit that maintains the language with volunteers, released two patches the same day and told administrators they were “encouraged to update immediately”.
Who went dark
The Dutch national cybersecurity agency took its own website down as a precaution, and others followed: the Port of Rotterdam, the government portal Overheid.nl, the KNVB football association, the websites of the five largest political parties and several hospitals. Prime Minister Rob Jetten said he was following the situation closely.
In Finland, the state IT provider Valtori took government public network services offline. France’s Interior Ministry put its sites, including those of local administrative offices, into preventive maintenance. Germany’s digital ministry pulled some websites as a precaution, and Belgium’s foreign affairs service went offline after reports of exploitation, although the national cybersecurity centre said it had recorded no attacks on Belgian sites. The Czech Republic also shut sites to patch them.
Outside Europe, South Korea raised its private-sector cyber alert level and sent guidance to about 28,000 companies. Japanese Prime Minister Sanae Takaichi used social media to warn about the risk. The Wikimedia Foundation took some systems down until they were patched, and the Internet Archive briefly went offline.
Found with AI, leaked early
Calif, working with OpenAI, reported the first flaw on 11 August, and Wiz reported the second on 24 August. Both teams used AI tools in the search. Wiz said the findings “rank among the most severe vulnerabilities discovered in PHP”.
The problem lies in how PHP handles fatal errors such as running out of memory. Wiz said this could also expose passwords and other credentials held in a server’s memory.
The details leaked online on 21 October, before fixes were ready. Amazon’s security chief, CJ Moses, said the company had detected an attempt to exploit the bugs on 17 October, before any public disclosure. How the attacker learned of them is not known.
Andrew Cullen, who lectures on AI and cybersecurity at the University of Melbourne, called the situation “really unprecedented”. The PHP Foundation said it expects AI to make such weaknesses easier to find, and has asked large technology companies to coordinate their response.
Sites that have installed the updates are protected. The risk now sits with the many smaller, older installations that are rarely maintained.