Two critical PHP flaws threaten 70% of websites
In brief
- Two critical PHP flaws (PHP2Shell) discovered, present for 20 years in all versions.
- 70% of websites exposed, including Wikipedia, WordPress, DeviantArt, and 4Chan temporarily shut down.
- Patches released today with severity 9.2/10; massive attacks before and after the announcement.
Two critical vulnerabilities in the PHP programming language expose a large portion of the internet to severe risks. Up to 70% of websites reportedly use PHP, which powers platforms like Wikipedia, WordPress, Drupal, DeviantArt, and 4Chan. Several of these sites were temporarily taken offline after the flaws were disclosed, including government services.
The vulnerabilities, present in every PHP version for nearly 20 years, affect even unsupported systems. Exploiting them requires a complex chain of steps, but AI models have made their discovery and malicious use easier. Patches were released today with a severity rating of 9.2/10, and agencies like the NSA recommend taking unpatchable systems offline immediately.
Attacks have already begun: thousands of exploit attempts were detected before the public announcement, rising to hundreds of thousands within two hours and millions afterward. Historical sites and services like Pokémon Home risk disappearing if patches aren’t applied.
What it changes for you
- CybersecuritySecurity teams must apply PHP patches immediately or isolate unpatchable systems to prevent remote code execution intrusions.
- Media & EntertainmentMedia and entertainment platforms must audit PHP infrastructures and temporarily suspend vulnerable services to avoid major disruptions.
- Public SectorGovernment agencies must prioritize updating PHP systems or take them offline to minimize risks of sensitive data compromise.
This summary gives you the essentials. The full article, its figures and quotes are on AI | The Verge.
Read the original articleAI-generated summary of the source, checked by rules. How we write · Report an error