tech
Critical PHP Flaw Affects 70% of Global Websites
PHP developers released emergency patches for a critical flaw affecting 70% of global websites after a leak on Hacker News.
Key points
- The PHP2Shell vulnerability allows hackers to take over web servers without requiring a password.
- AI discovered the flaws which had been hidden in the code of PHP for more than a decade.
- Government websites in the Netherlands, Finland, France, and Denmark were taken offline as a precaution.
Why it matters. Because PHP runs roughly 70% of all websites, this vulnerability puts a large portion of the internet at risk of unauthorized server takeovers.
PHP developers released emergency patches on October 21 after a leak on Hacker News revealed a critical flaw. The vulnerability was discovered in August by Wiz researchers using Gemini and ChatGPT AI models to analyze the codebase. The Port of Rotterdam and several European governments took websites offline, while agencies in Australia, the US, UK, Europe, and Japan urged urgent updates.
Latest updates
Critical PHP Flaw Affects 70% of Global Websites
A critical security flaw has been discovered in PHP, the backbone of more than 70% of all websites. If left unpatched, the vulnerability allows hackers to compromise millions of servers and steal sensitive data. Multiple European governments and operators have issued urgent warnings to developers. Emergency patches have been released to mitigate the risk of widespread system takeovers.
CERT-In Warns Of Critical PHP2Shell Flaw As Global Websites Go Offline
CERT-In has rated two new PHP vulnerabilities as critical following widespread website failures. The flaw, identified as PHP2Shell, has impacted various government portals and parts of Wikipedia globally. Security experts warn that the vulnerability allows unauthorized access to servers. Users and administrators are advised to patch their systems immediately to prevent exploitation.
Critical PHP2Shell flaw forces governments and major sites offline
A severe security flaw dubbed PHP2Shell has triggered a global scramble as website operators proactively took critical infrastructure offline. The vulnerability, discovered using artificial intelligence, affects the PHP programming language running a vast majority of web servers worldwide. Millions of automated attacks were logged within hours of the disclosure, prompting urgent patches across corporate and public networks. Educational institutions, healthcare portals, and government domains in multiple regions were temporarily disabled to prevent unauthorized access. Cybersecurity agencies have issued high-alert warnings and released emergency mitigation instructions for system administrators.
PHP2Shell vulnerability forces governments and hospitals to take sites offline
The PHP2Shell vulnerability is a decade-old flaw that allows unauthorized access to web servers. Governments, universities, hospitals, and Wikipedia have taken sites offline to prevent exploitation. Millions of attacks were logged within hours of the flaw's discovery. Website owners are being urged to patch systems to mitigate the risk.