AI uncovers critical PHP security flaws: Why website owners must patch servers immediately

Companies and governments around the world are racing to secure their servers after developers disclosed critical vulnerabilities in PHP, one of the internet’s most widely used programming languages.

The flaws, which had remained undetected for years before being uncovered with the help of artificial intelligence (AI), have triggered warnings about potential server takeovers and a surge in hacking attempts following their disclosure.

PHP developers released urgent security fixes on October 21, urging users to update their installations immediately. The vulnerabilities have also prompted cybersecurity experts to warn organisations against assuming that their systems are safe simply because they do not actively use PHP for web development.

Matthew Prince, CEO of cloud services firm Cloudflare, highlighted the urgency in a post on X, warning about two separate classes of cybersecurity vulnerabilities disclosed within 24 hours. While one concerns compromised digital certificates that could undermine trust in online communications, the other affects PHP installations and could allow attackers to gain control of vulnerable servers.

What are the PHP vulnerabilities? 

The vulnerabilities, dubbed “php2shell”, affect PHP, a server-side programming language used to build and operate websites and web applications. PHP processes requests on a web server and can interact with databases, files and other server-side resources.

MUST READ | Critical PHP vulnerabilities: What is it, how it can affect websites & what should users know?

According to Prince, PHP is estimated to power around 70% of websites, making vulnerabilities in the language a potentially significant security concern.

The newly-disclosed flaws could allow an attacker to send specially crafted requests to a vulnerable server and potentially execute commands on it. If successfully exploited, this could give an attacker the ability to access, modify or delete files, interfere with applications, steal information or repurpose the compromised server for malicious activity.

The extent of the damage would depend on the vulnerability exploited, the server's configuration, the privileges available to the PHP process and the security controls in place. A vulnerable installation does not automatically mean a server has been compromised, but leaving it unpatched can expose it to attack.

Why are the flaws particularly concerning? 

The vulnerabilities are concerning for two reasons: the widespread use of PHP and the possibility that AI-assisted techniques helped uncover weaknesses that had remained hidden for years.

The discovery illustrates how artificial intelligence is increasingly being used to identify security flaws in established software. While such capabilities can help developers find and fix weaknesses, they can also raise concerns about how quickly attackers might exploit vulnerabilities once technical details become public.

DON'T MISS | eMudhra certificate alert: How to update Windows, macOS and Linux devices for better security

The disclosure of a flaw can create a race between defenders deploying patches and attackers developing exploits. The reported increase in hacking attempts after the vulnerabilities were disclosed underscores the importance of applying security updates promptly.

Organisations that delay patching may remain exposed even if they have not observed suspicious activity on their systems.

What has Cloudflare done to protect users? 

Cloudflare said it had received advance warning of the vulnerabilities and had deployed protective measures for its customers.

The company introduced mitigations against the PHP vulnerabilities and released additional web application firewall (WAF) capabilities designed to identify exploitation attempts by examining server responses. Cloudflare said these protections were available to all its customers at no additional cost.

However, the company stressed that these measures should not replace installing the official PHP security updates. Protective services can reduce the likelihood of successful attacks, but they cannot guarantee that every exploitation attempt will be blocked.

FIND HOW | What is eMudhra certificates? What to know about the security scare and could your data be at risk?

Cloudflare also advised organisations to upgrade their operating systems and browsers to address the separate digital-certificate issue disclosed around the same time.

What should website owners and businesses do? 

Security experts have urged organisations to prioritise the following steps:

• Update PHP immediately: Install the latest security-fixed version applicable to the system and verify that the update has been applied successfully. 
• Check every server: Identify PHP installations across production servers, cloud environments, development systems and legacy infrastructure. 
• Remove unused installations: PHP may be present even when a business does not actively use it. Remove it if it is unnecessary, or keep it updated if required. 
• Review server activity: Examine logs for suspicious requests, unexpected processes, unauthorised file changes and other signs of exploitation. 
• Use additional security controls: Deploy web application firewalls and other protective measures, while treating them as supplementary safeguards rather than substitutes for patching. 
• Investigate potential compromise: If a server may have been exploited, follow an incident-response process to contain the threat, preserve evidence, assess the extent of access and restore systems securely. 

Organisations should consult the official PHP security advisories to identify the affected branches, fixed versions and precise upgrade requirements before making changes to production systems.

What is the separate digital-certificate vulnerability? 

The PHP flaws were disclosed alongside a separate issue involving root TLS certificates associated with eMudhra. TLS certificates help browsers and other systems verify the identity of websites and establish encrypted connections.

DO CHECKOUT | eMudhra certificate alert: How to update Android and iPhone apps to improve your device security

Prince said the affected certificates had an extremely weak private key, reportedly the number “4”. If an attacker could exploit the weakness and intercept traffic, they could potentially create fraudulent certificates and impersonate affected online services.

Cloudflare said it had stopped trusting the vulnerable certificate roots where it operates as a proxy and was monitoring certificate-transparency logs for evidence of possible exploitation. The company said it had not found evidence of exploitation, while cautioning that such logs cannot rule out every possible attack.

The recommended response for users is to install operating-system and browser updates that remove trust in the affected certificates. This issue is distinct from the PHP vulnerabilities, and fixing one does not resolve the other.