Article · AI translation
IT Home reported on October 28 that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers are actively exploiting two serious security vulnerabilities in widely used PHP web software to launch attacks. It has ordered civilian agencies across the U.S. federal government to fix their systems within the next 3 days.
IT Home noted that, less than a week before this urgent security warning, the maintainers of the decades-old PHP web programming language had released patches for the two vulnerabilities. Hackers can exploit them to remotely break into vulnerable systems over the internet without a password. According to reports, about 70% of internet-facing servers use PHP, putting many websites and applications at risk. Because the vulnerabilities are serious, some government agencies and large companies have temporarily shut down affected websites while they make repairs.
Although both vulnerabilities are rated severe, meaning they could cause significant damage if exploited, security researchers say developing attack code that can successfully compromise vulnerable systems is difficult, though not impossible. Evidence now confirms that hackers are exploiting the vulnerabilities in real-world attacks, increasing the urgency for organizations to fix their systems to prevent malicious intrusions, business disruptions and data breaches.
In a statement issued Monday, CISA did not disclose the specific targets of attacks exploiting these vulnerabilities. Shortly before the statement, however, security researchers said they had found evidence that the PHP vulnerabilities were being exploited in the wild.
The two vulnerabilities, known as PHP2Shell, stem from security flaws in the software that went undetected for years. The vulnerabilities were first discovered 2 years ago, but the nonprofit foundation responsible for maintaining the software said at the time that hackers could not actually exploit them to launch attacks, so it did not release patches.
That changed only earlier this year. Researchers at the security firm Calif used an artificial intelligence model to find a way to exploit the two long-dormant vulnerabilities in attacks.
These two PHP vulnerabilities are just some of a large number of potential security flaws. Many have yet to be discovered, while others have received too little attention for years. As artificial intelligence models become increasingly capable of finding and exploiting vulnerabilities, including by chaining multiple flaws together in an attack, these long-overlooked security weaknesses are gradually becoming real threats.
PHP is one of many longstanding web technologies that have long supported the operation of the internet and modern technology, but it has faced insufficient resources and funding for years. This makes it difficult for open-source projects such as PHP to afford security audits, which could help uncover software vulnerabilities earlier.