After discovering serious security vulnerabilities in software that affect a large number of websites and applications on the Internet, the tech community is racing to introduce remedial measures.
This software, named PHP, is an open-source programming language widely used to power websites and web applications. After the vulnerability was discovered, governments around the world issued urgent warnings; technology giants including Google, OpenAI, and Amazon also participated in the effort to find the vulnerability, detect potential attacks, and protect affected systems.
According to cybersecurity researchers, these two vulnerabilities are collectively referred to as “PHP2Shell” and may allow hackers to remotely execute malicious code on affected servers, potentially exposing sensitive data. Although not all websites that use PHP necessarily have these vulnerabilities, due to its widespread use, there is concern that the scale of potential attacks could be significant.
On Wednesday, the National Security Agency (NSA) urged organizations that use PHP to prepare for security updates addressing these vulnerabilities, warning that these flaws could allow attackers to directly access server file systems and databases. The agency recommended that if updates cannot be made immediately, affected systems should be taken offline until the vulnerabilities are completely fixed.
The Federal Bureau of Investigation (FBI) also warned that malicious actors could exploit these vulnerabilities to remotely execute code, posing risks to sensitive data and networks.
Cybersecurity agencies in Singapore, the UK, Australia, Canada, and the European Union have also issued similar alerts, highlighting the potential impact these vulnerabilities may have on enterprises, government agencies, and other organizations that rely on the PHP system.
Amazon indicates that its threat intelligence team detected attempts to exploit these vulnerabilities before they were publicly disclosed through the MadPot threat detection system, which monitors suspicious activities in internet infrastructure. Amazon states that these findings suggest that malicious actors were already attempting to exploit these vulnerabilities at that time. However, Amazon indicates that it is still unclear how the attackers obtained this vulnerability information before it was made public.
At the same time, Google and OpenAI emphasized the increasingly important role of artificial intelligence in identifying and responding to cybersecurity threats. Google stated that its cybersecurity department Wiz uses AI models to help discover and investigate these vulnerabilities, while Gemini AI is involved in assessing vulnerabilities, testing potential attacks, and verifying security patches.
OpenAI indicates that researchers collaborating with the AI model also helped to discover a serious vulnerability in PHP. The company stated that for the past two months, it has been leading an alliance composed of software maintainers, cybersecurity researchers, and security service providers to coordinate the repair efforts and to prepare protective measures before making the discovery public.
This ChatGPT developer describes these vulnerabilities as one of the most important security issues in recent years, emphasizing that advanced AI systems are capable of identifying vulnerabilities in widely used software, but they may also be exploited by cyber criminals.
Cloudflare, which provides network security and website infrastructure services, stated that it has deployed protective measures against PHP2Shell vulnerabilities through its Web application firewall. The company said that these measures are intended to help intercept malicious requests targeting affected systems and provide an additional line of defense during the period when organizations are installing software updates.
The PHP development team has released a security fix, and relevant organizations are urging website operators to identify the affected versions as soon as possible and apply the update. This incident highlights that vulnerabilities in widely used software can pose risks regardless of industry or national boundaries; at the same time, AI is playing an increasingly important role in helping security researchers to discover and fix these weaknesses.
