What’s the PHP coding flaw that could pull down 70 percent of the internet?

Developers of the PHP programming language released urgent new fixes on Wednesday, encouraging all users to update immediately after critical vulnerabilities were discovered. The flaws had been lurking in the software for years and were uncovered with the help of artificial intelligence.

Details about the vulnerabilities leaked online on Tuesday before fixes were available, forcing PHP to rush them out. Experts warned they were bracing for a wave of intrusions as hackers moved to exploit the flaws before websites could patch them.

Critical vulnerabilities

The two flaws, nicknamed PHP2Shell, allow hackers to run code on websites, potentially changing them or forcing them to release personal information from databases. Both flaws scored 9.2 out of 10 on the industry's standard severity scale, placing them in the "critical" category.

The vulnerabilities stem from how PHP handles fatal errors, such as running out of memory. Because the problem is in PHP itself, even the simplest website running an affected version can be vulnerable, allowing attackers to read passwords and other credentials from a server's memory.