A critical security vulnerability has been discovered in the widely used programming language PHP, prompting alarm among businesses and institutions worldwide.
According to reports from The Wall Street Journal and Reuters on October 21, the vulnerability, dubbed 'PHP2Shell,' arises from how PHP manages computer memory. If exploited, hackers could execute arbitrary programs or take control of vulnerable web servers.
This vulnerability was notably identified using artificial intelligence (AI) and is considered a serious security flaw that had gone undetected for over a decade.
Countries across Europe, including the Netherlands, Finland, Denmark, and Belgium, have begun shutting down major websites and online services. Reuters reported that in the Netherlands, government portals, the Port of Rotterdam, and major hospital websites have gone offline, while public networks and school platforms in Finland and Denmark have also been disabled.
In Belgium, government agencies, parliament, school platforms, and major media websites have ceased operations. The European Union's cybersecurity agency has advised immediate application of PHP security patches and recommended taking websites offline if updates are not feasible.
According to Yonhap News, the United States has also raised its alert level regarding the PHP vulnerability. The National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) warned that exploiting the flaw could allow unauthorized access to servers and data or enable remote code execution, urging immediate updates and offline measures if necessary.
On October 21, the PHP development team released an urgent update addressing two critical security vulnerabilities. However, since website operators must apply these updates themselves, it may take time for the situation to stabilize. Concerns have been raised that hackers could reverse-engineer the patch using AI to discover new attack methods.
The significance of this incident stems from PHP's extensive use as a core technology across the internet. Known as the 'backbone of the web,' PHP powers approximately 70% of all websites globally, including popular platforms like WordPress and Wikipedia.
The role of artificial intelligence (AI) in identifying this security flaw has heightened concerns about AI-driven hacking.
Cybersecurity firm Caliph utilized OpenAI's model 'GPT-5.6 Sol' to uncover the vulnerability, while Google-affiliated cybersecurity company Wiz independently discovered and reported two vulnerabilities. This flaw had existed in PHP code for over a decade and had long been flagged as a potential issue, but it was previously thought to be difficult to exploit.
Ami Lutwak, co-founder of Wiz, described the vulnerability as “the most serious security flaw discovered by AI to date,” adding that “it would have been too complex to find without AI.”
OpenAI also stated that given the severity of the flaw and the widespread use of PHP, it is considered one of the most impactful security vulnerabilities in recent times.
Criticism has emerged that some companies released security patch codes earlier than promised, exacerbating the threat.
The PHP Foundation announced on October 21 that the patch distribution company 'ChainGuard' prematurely disclosed images of the patch over six hours before the official release time. The foundation criticized ChainGuard in an official statement, stating, “ChainGuard unilaterally broke the embargo,” and condemned the act as disregarding the efforts of numerous parties who had worked for weeks on coordinated disclosure.
An early release of the patch could allow hackers to reverse-engineer the patch code to develop attack tools. By providing hackers with a six-hour head start to analyze the code before the official update was available, users were left vulnerable to hacking threats.
This incident is part of a broader pattern of information leaks that occurred even before the official patch distribution.
The PHP development team initially planned to release the patch on October 22, but after vulnerability IDs began circulating online on October 20, they moved the release date forward by a day. Additionally, another security firm, Caliph, mistakenly uploaded a video demonstrating an attack exploiting the vulnerability before deleting it, which the foundation noted accelerated the development of hacking tools.
In this context, the premature patch release by ChainGuard has been seen as a breakdown of the 'time-lag defense.' With advancements in AI tools, the speed at which patch codes can be reverse-engineered to create attack tools has increased dramatically, making such coordination failures particularly damaging.
Tai Duong, CEO of Caliph, expressed concern, stating, “Someone could take the patch, run it through AI, and post scripts to exploit it, leading to chaos.”
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.