New Delhi: Government websites in the Netherlands, France, Finland, Denmark and Canada were taken offline Wednesday as their operators moved to fix two security flaws in PHP, a programming language used by about 70 percent of websites. The flaws allow an attacker to take control of the computer that runs a website without needing a password.
The developers of PHP released a fix at about 7:05 pm Indian Standard Time (IST) Wednesday, a day ahead of schedule, after details of the flaws were leaked online. Attacks had begun before the fix was released.
The Indian Computer Emergency Response Team (CERT-In), the national cyber security agency under the Ministry of Electronics and Information Technology (MeitY), has classified the flaws as critical, and the United States National Security Agency (NSA) has said the risk is serious enough to require immediate updates across US government departments.
The two flaws, together named “PHP2Shell”, were identified by researchers using artificial intelligence (AI) models developed by OpenAI and Google.
Also Read: What’s the eMudhra security scare that has rattled the internet? All you need to know
What is PHP
Every website is stored on a computer called a server, which is connected to the internet at all times. When a person opens a website, their phone or laptop sends a request to that server, and the server sends back the page.
PHP, or Hypertext Preprocessor, is a set of instructions that tells the server how to respond. It may be compared to the staff in the back office of a shop. The customer sees only the counter, but the staff behind it take the order, check the records and hand over the item. Similarly, when a user logs in, searches a website, fills a form or makes a payment, PHP often handles the request and retrieves the information from the website’s records.
WordPress, which runs a large share of blogs and news websites, is built on PHP, as are Drupal, Joomla and Magento, a platform used by online stores. Since the flaws are in PHP itself, a website may be exposed even if the people who built it made no errors of their own. Updating WordPress or its add-ons does not fix the problem; the company hosting the website has to update PHP.
What flaws allow
A server keeps information it is working on in its memory, much as a clerk keeps files on a desk while handling a customer. Once the work is done, the desk is meant to be cleared before the next customer arrives.
The flaws relate to what PHP does when a request fails, for instance when the server runs out of memory. In certain cases, PHP does not clear the desk properly, and the leftover information can be misused by the next request. By sending a request written in a specific way, an attacker can make the server carry out the attacker’s own commands. In security terms, this kind of access is called a “shell”. It is comparable to an outsider obtaining the keys to the back office.
With this access, an attacker could steal data, change what a website shows, shut it down, or use it to enter other computers on the same network. The flaws can also expose passwords stored in the server’s memory. Both flaws have been rated 9.2 on a 10-point scale used to measure how serious a security problem is. Researchers said the oldest affected instructions date to a version of PHP released in 2012.
How flaws were found, leaked
Calif, a security firm working under OpenAI’s “Patch the Planet” programme, identified the first flaw on 1 August and reported it to PHP’s developers on 11 August. Wiz, a cyber security company owned by Google, found the flaws independently on 19 August and reported them on 24 August.
Both said they used AI models to find the flaws and build working attacks. Wiz researchers said a single researcher using these tools completed in a week work that would earlier have taken a team months.
In a statement, OpenAI said it had led a group of PHP’s developers, researchers and security companies for two months to prepare the fix, which required a change to the core of PHP. It described the flaws as among the most serious in recent memory, and said AI had found them before attackers did, giving defenders time to prepare.
Researchers generally inform developers privately and make a flaw public only once a fix is ready. The flaws were to be announced on 22 October. On 20 October, however, an anonymous post online said two PHP flaws were about to be disclosed, and a video appearing to show the attack circulated before being removed. PHP’s developers then brought the release forward.
Attacks before, after the fix
Cloudflare, a company that protects a large number of websites, said it switched on protections for its customers about nine hours before the fix was released, and saw attackers altering their methods to get around them. Matthew Prince, Cloudflare’s chief executive, wrote Thursday that the company recorded thousands of attempts to exploit the flaws in the 10 hours before the announcement. This rose to tens of thousands within 45 minutes after it, hundreds of thousands within two hours, and millions by Thursday morning.
In the Netherlands, the national cyber security centre took its own website offline, followed by the government’s digital identity service, the website of the House of Representatives, the Port of Rotterdam and several hospitals. France’s Interior Ministry took down the websites of prefectures, including the Paris police prefecture. Finland’s state IT centre shut the government’s public web services as a precaution and said it had found no attempt to exploit the flaws. A national school platform was affected in Denmark, and Canada’s minister for AI and digital innovation said some government websites were temporarily taken offline.
The NSA said attackers are likely to use the flaws, and asked organisations to replace PHP versions that can no longer be updated and to take systems offline if they cannot be fixed immediately.
India’s response
CERT-In issued a note on 21 October stating that a remote attacker could run commands on a targeted system and gain complete control of it. It advised all organisations and individuals using PHP to install the updates. The agency has not stated whether any Indian websites were affected.
The fix is available in the four latest versions of PHP. Older versions are no longer maintained and will not receive an official update. On 20 October, security firm Mallory counted about 8.84 lakh servers connected to the internet still running these older versions. Web hosting companies began rolling out the fix to their customers Wednesday evening.
Users visiting websites are not required to take any action. Some websites may remain unavailable while updates are carried out.
The alert follows a CERT-In advisory on 15 October, which stated that AI agents had accessed systems of Indian organisations without detection, and the withdrawal of trust this week by Google and Mozilla in security certificates issued by Bengaluru-based eMudhra.
(Edited by Amrtansh Arora)
Also Read: Govt-backed report raises alarm—frontier AI models can now attack banks with minimal human help