US Government Warns: Cybercriminals Target Vulnerabilities in PHP Web Applications
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that cybercriminals are actively taking advantage of two serious vulnerabilities within the widely utilized PHP web software. CISA has mandated that federal civilian agencies in the U.S. address these vulnerabilities within three days.
This urgent directive follows closely behind the release of patches from the developers of PHP—an established web programming language—targeting the critical bugs. These vulnerabilities enable hackers to access vulnerable systems remotely over the internet without needing any passwords. Given that approximately 70% of web-facing servers utilize PHP, major websites and applications are now at heightened risk. Due to the severity of these issues, some organizations, including governments and large corporations, have taken their services offline to apply the necessary fixes.
Despite the critical rating of these vulnerabilities, which suggests significant potential damage, security experts initially found it challenging, though not impossible, to create effective exploits to breach these systems. The recent confirmation of these vulnerabilities being exploited in the wild exacerbates the urgency for organizations to implement patches to safeguard against malicious activities, disruptions, and potential data breaches.
CISA did not disclose specific details about the entities behind these exploitations, but their alert came shortly after researchers reported evidence of these PHP vulnerabilities being utilized in cyberattacks.
The vulnerabilities, referred to as PHP2Shell, pertain to flaws in the software that remained hidden for an extended period. Originally identified two years ago, the nonprofit organization responsible for maintaining PHP noted that there were no viable methods for hackers to exploit them, leaving the vulnerabilities unaddressed until this year, when researchers from a security firm discovered a means to exploit these dormant issues with the aid of artificial intelligence.
These two PHP vulnerabilities are part of a broader spectrum of unaddressed security flaws, many of which have been neglected or de-prioritized over the years. The rise of AI technologies has enhanced the capacity to discover and exploit these vulnerabilities, even by linking multiple flaws together.
PHP, along with numerous outdated web technologies that underpin the internet and modern systems, has endured years of underfunding and lack of resources, making it challenging for open-source initiatives like PHP to finance security audits that could have identified these flaws earlier.
