Critical security flaw puts most websites at risk as NSA issues warning

Millions of sites may not get PHP patch

Jessica Guynn

While emergency security fixes for a pair of critical flaws affecting the technology powering nearly three-quarters of the internet were rushed out Wednesday, security experts issued another warning: Nearly half of all affected websites may never receive the patch, leaving millions of websites exposed to cybercriminals.

Cybersecurity firm Cisco Talos estimates that about 50% of all PHP systems worldwide will not receive an official patch for two newly discovered security issues.

The reason? Aging websites rely on outdated, unsupported versions of PHP and there is no easy fix to update them, creating fertile ground for hackers to hijack servers, spread malware or steal data.

AI is uncovering security flaws. The internet can’t keep up

Jessica Guynn

Researchers say a massive shift is taking place in the security landscape with new vulnerabilities being unearthed at an unprecedented rate by increasingly capable AI tools.  

For months, advanced AI models have been deployed to root out vulnerabilities and fix them before they can be exploited by hackers. But what happens when the internet can't move quickly enough to patch the flaws? Case in point is the critical security issue in programming language PHP used in as much as 70% of websites. 

“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said in blog post. “It highlights how AI can uncover security flaws with internet-scale impact but the same capabilities can also help attackers rapidly develop offensive tools and exploits.” 

Raghu Nandakumara, vice president of industry strategy at Illumio, said in an emailed statement that the security world has to catch up.

“The faster AI becomes at finding weaknesses, the more important it becomes to think about what happens after those weaknesses are exposed, especially when organizations can’t immediately patch every affected system," he said. "The lesson isn’t that AI is inherently dangerous or inherently protective. It’s that speed without control creates a new kind of security problem." 

NSA advises organizations to go offline if update isn't available

Greta Reich

The National Security Agency's central security service notified organizations running on PHP software to take their systems offline if they cannot immediately update their services.

"Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities," the NSA wrote in a Wednesday statement.

"These vulnerabilities often provide a direct path to the server's file system or database," the statement continued. "If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated."

They added that they will follow up shortly with more specific guidance.

Is browsing the web safe today? Expert breaks down critical PHP security attacks

Jessica Guynn

Is browsing the internet safe today? 

In an interview with USA TODAY, Daniele Molteni, director of project management at Cloudflare, broke down what security researchers know about the PHP vulnerability and what dangers still lurk on the web. 

Q:How does the PHP software vulnerability affect everyday users of the internet? 

A: php2shell affects servers running vulnerable PHP software rather than consumers’ phones or browsers directly. But PHP underpins many services people use every day, from personal blogs and online stores to government websites. It is used by roughly 70% of websites whose server-side programming language is known. Successful exploitation could expose customer information, let attackers change a website or disrupt access to services. Website operators and hosting providers need to update PHP promptly to protect the people who depend on them. 

Q:What happens to people who visit an affected site? 

A:A vulnerable website has not necessarily been compromised and visiting one does not automatically infect someone’s device. If an attacker successfully exploits the server, however, they could access sensitive information, alter what visitors see or take the service offline. Some effects would be visible; others, such as data exposure, might not be. Consumers should follow security notifications from services they use.

Q: Did Cloudflare see any attacks or attacks in the making? How vulnerable does the internet remain? 

A:Cloudflare has observed exploit attempts including spikes of thousands of attempts. We also saw attackers modifying their tactics to try to bypass protections. Those observations describe attack attempts; they do not, by themselves, establish successful compromises. Our analysts continue to monitor activity and update the rules as new variations emerge. Unpatched deployments remain a concern.  

Governments rush to take down websites

Miles J. Herszenhorn

Governments around the world rushed to take down their websites amid fears that hackers could exploit the PHP vulnerabilities. 

The websites of the cybersecurity centers for the Dutch and Belgian governments went dark to perform maintenance and make the necessary fixes to address the PHP issue.

The Dutch government’s National Cyber Security Center said it had taken its website down as a precaution and set up a page on GitHub to offer technical information about the vulnerabilities. 

“Due to vulnerabilities in PHP, we have temporarily taken our website (NCSC.NL) offline as a precaution,” the center wrote in a statement posted online. “We are working hard on a solution and are doing everything we can to make the website available again as soon as possible.”

CERT-EU, the European Union’s inter-institutional cybersecurity and incident response center, recommended that websites be taken down if fixes could not be implemented immediately.   

“Where immediate patching is not feasible, organisations should consider isolating internet-facing resources from public networks until the fix is applied and verified,” the center wrote in a security advisory.

Japanese Prime Minister Sanae Takaichi even weighed in on social media. She issued an “urgent request” to operators of websites that use PHP to take action to address any vulnerabilities. 

“Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight,” she wrote. “If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk.”

Critical flaw sparks attacks amid warnings of resource shortage

Jessica Guynn

The nonprofit PHP Foundation, which maintains the PHP programming language, released emergency software updates to fix the critical vulnerabilities. The major concern? Hackers could still take advantage of the vulnerabilities before they are patched.

Internet infrastructure company Cloudflare said it spotted attempts before the PHP Foundation released fixes. 

"We are seeing early attacks emerging and are updating mitigations as new vectors show up," Cloudflare's CTO Dane Knecht said on X. 

The PHP Foundation warned that its security work relies on a small number of developers and "a little volunteer help," even as security threats loom larger than ever. 

"Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing," the foundation said in a blog post. "What tools cannot do is decide on the right fix for a long-standing design decision in the engine, weigh the compatibility trade-offs and review the patch. Making those decisions takes experienced engineers who know the entire PHP codebase and today there are too few of them."

Elizabeth Barron, executive director of the PHP Foundation, told USA TODAY that her organization is underfunded and increasing support is critical to its survival.

"If the PHP Foundation goes away, so does all the work that we do to support the language. Without the foundation, critical functions like security, maintenance and core infrastructure fall solely to volunteers who can only contribute when they have the time and capacity to do so," Barron said. "This issue has surfaced how reliant people are on the PHP language. It is not an exaggeration to say that if the PHP language ceased to exist, millions of people would be affected."

PHP security update: What everyday internet users need to know

Jessica Guynn

Security experts have issued an urgent warning after the release of emergency security updates for PHP, the underlying technology that powers three-quarters of websites worldwide. So what should everyday internet users do?

"You can do everything right online and still have your personal information stolen. That's the frightening reality of today's cybersecurity landscape. AI is helping uncover software vulnerabilities at unprecedented speed, creating a flood of potential security weaknesses that companies are struggling to address. For everyday internet users, that means the banking, shopping and healthcare apps they trust could have vulnerabilities hackers can exploit before they're fixed," Darren Meyer, research advocate with Checkmarx, told USA TODAY in an email. "The challenge is that consumers can't see these weaknesses. You might have the strongest password in the world but that won't protect you if a website you use has a serious security flaw."

So what can consumers do? The simple answer is not much. But you can still protect yourself. Here's how:

• While website administrators rush to apply security patches to the remote servers that host the sites you visit, remain vigilant for unprotected sites that could be compromised by cybercriminals.
• Stick to trusted sites and watch out for unexpected emails, texts or messages claiming to come from the websites you frequent.
• Enable two-factor authentication on important online accounts such as email and banking.
• Keep your operating system and browser updated.
• Heed warnings from your web browser if it blocks a site as a security risk and leave the page immediately.
• Website owners should log into their web hosting control panel or contact their hosting provider immediately to confirm that servers have been updated to the latest patched version of PHP.

From July to October: A timeline of the patch

Greta Reich

Calif researcher Ryan Austin initially found the PHP bugs in July while working in collaboration with OpenAI's Patch the Planet initiative.

On Aug. 1, the digital infrastructure company reported the bugs to security engineer Volker Dusch at the PHP Foundation, a nonprofit that supports developers who maintain the PHP programming language. Dusch shared the findings internally and they began working on patching the issues, according to Calif security researcher Bruce Dang.

Since August, Calif has ben working with OpenAI and Google Wiz — Google's cloud and AI security startup that independently found out about the bugs — to create a patch (or fix) and coordinate a release. Dang told USA TODAY that the patch has been done for a few weeks, but they have been testing it before going public.

"You don't want to release the patch to the public too early," Dang said. "Because as soon as it goes out, other people, other security researchers and other hackers are going to be able to reverse engineer that patch."

The patch was originally supposed to be publicly released on Thursday, Oct. 22, but Hacker News leaked news of the patch two days in advance, on Tuesday, Oct. 20, so it was released Wednesday instead.

"This patch is huge," Dang added. "Typically, most security patches are relatively small and surgical. This one is very large, and so the chances of a mistake or an incomplete fix is is much higher than usual, so all of the parties involved wanted to make sure that the patch was solid before we released it."

White House says it's working to expedite release of software fix in US

Joey Garrison

The Trump administration is working with federal agencies and artificial intelligence companies to "expedite the release" of the fix to users of the PHP programing and to protect American networks and critical infrastructure, the White House said in a statement.

The administration was notified on Friday, Oct. 16 of the PHP software vulnerability, which was discovered through AI technology. The open-source software is used by about 70% of websites globally.

The White House touted the fact it was AI ‒ which Trump has coined "super intelligence" ‒ that identified the vulnerabilities. Trump has pushed back against calls to regulate the rapidly growing AI industry.

“President Trump is committed to ensuring America leads the world in Super Intelligence, and this discovery demonstrates exactly why American leadership in SI is so critical," the White House said in a statement. "Advanced SI technology helped identify a cybersecurity vulnerability, allowing experts to develop a solution that would mitigate widespread disruptions."

What is a PHP and why is it important?

Greta Cross

PHP, which stands for PHP: Hypertext Preprocessor, is a popularly used, open-source server-side scripting language used to develop websites and applications, according to educational computing site W3Schools. A PHP can generate dynamic page content; create, open, read, write and delete files on a server; collect form data; send and receive cookies; add, delete or modify data in a database; and encrypt data, as outlined by W3Schools.

As of this month, nearly 70% of all websites that have a known server-side language (when users can identify a site’s programming language) use a PHP, according to web tech survey platform W3Techs. Some of the world’s most popular websites use PHP, including WordPress, Facebook, Wikipedia, Slack, Etsy and Upwork, according to software development agency Trio.

And countless more are built on WordPress, including the White House and NASA websites.