What to know about the PHP bug affecting 70% of world's websites

The security weakness affects PHP, a programming language that powers up to 70% of the world's websites and web applications, including those used by government agencies and social media platforms such as Facebook. The bug, dubbed PHP2Shell, was identified by ethical hackers in California using advanced AI models, which proved critical in spotting the vulnerability that had existed for at least a decade.

PHP is everywhere — not everyone who is using it even knows that they're using it because it's this ubiquitous technology that's been baked into the internet for years and years. There are a lot of sites that I don't think even know that they have a problem and they may find out the hard way.

AI discovery race

The discovery highlights the battle between cybersecurity experts and hackers over how to use AI to spot potential holes in technology systems. In this case, security researchers were the first to uncover the bug.

"People knew something weird was going on. But no one could really find a way to write an exploit — of turning a bug that might cause a computer to crash into something really bad that would allow somebody to run software that they weren't supposed to be able to run on a computer," McMillan said.

The researchers found the vulnerability particularly complex and tedious to detect manually. "It would take a lot of work for a human to be banging away for months and months to figure out what was going on. But an AI can do that menial, complex, long-term task much more quickly," McMillan explained.

Critical patch window

Andrés Guerrero-Saade, vice president of intelligence and security research at SentinelOne, told CBS News that the incident illustrates "how AI is accelerating the ability of vulnerability researchers" while also boosting bad actors' capacity to exploit security flaws.

The time between a vulnerability being detected and a fix being released is crucial for cybersecurity experts. "That whole gap between the patch being available and attackers getting to exploit that before anybody patches, that's the whole game essentially," Guerrero-Saade said.

He noted that AI has shortened this vital window of time, allowing cybercriminals to move much faster today than in the past. "We are just out here trying to get folks to patch on time," he added.

Response and impact

The PHP Foundation has released fixes for the vulnerabilities, along with instructions on how to update systems. "If you run PHP, it is imperative that you update now," the group said.

The FBI's cyber threat division acknowledged the vulnerabilities, which expose websites and apps to interference from cybercriminals who can remotely insert malware into PHP's source code, "potentially compromising sensitive data and networks." The FBI is encouraging organizations that can't immediately patch their sites to temporarily take them offline.

Voldemaras Kadys, head of security at Mediatech, warned that "two critical security flaws were discovered in PHP that could allow hackers to take control of vulnerable website servers and potentially steal customer information, change website content, install malware or take the website completely offline." The potential impact could be huge, as most websites run on PHP.

Consumer advice

Consumers' personal information could be vulnerable if they have an account with an online store or booking platform whose site is not secure. "For regular internet users, simply visiting a PHP website doesn't necessarily mean their device will be compromised," Kadys explained.

The risk lies in attackers exploiting websites that hold users' personal information. "If a user has an account with an online shop, attackers may be able to hack that website through this PHP vulnerability and extract the information the user has stored there, such as their email address, physical address, name and date of birth," he said.

Kadys advised that there's no reason to stop browsing or shopping online, but users should be extra cautious about suspicious messages. "We don't know what kind of data hackers may have stolen through this vulnerability, and from which websites," he added.