A PHP vulnerability that prompted Finnish authorities to shut down government websites could affect as many as 70 percent of websites worldwide, according to cybersecurity company Wiz.
In the worst case, the vulnerabilities could allow an attacker to take control of a server without authentication.
Wiz says the issue is particularly serious because the vulnerabilities are found in the core of the PHP programming language itself, rather than in an individual online service or content management system.
PHP is one of the most widely used server-side programming languages on the internet. It underpins platforms including WordPress, Drupal and Joomla, as well as MediaWiki, which is used by Wikipedia.
According to Wiz, the vulnerabilities can be exploited to read sensitive information stored in a server’s memory and, in some cases, to remotely execute code without authentication. The company demonstrated working attacks against WordPress, Drupal and Joomla environments.
The problem is not limited to those platforms. Wiz says the vulnerable component is part of PHP itself, meaning even a very simple web application could be at risk if it runs a vulnerable version of PHP.
Finnish government websites taken offline
Finland’s Government ICT Centre Valtori began shutting down public-facing government websites as a precaution on Wednesday because of the vulnerability.
Valtori said at the time that there was no evidence the vulnerability had been actively exploited. The services were taken offline before patches were installed.
PHP released patched versions addressing the vulnerabilities on Wednesday. According to Wiz, at least one of the newly discovered flaws affects virtually every PHP version released over the past decade, going back as far as PHP 5.4.
Problems with Finnish government services continued on Thursday.
AI turned old bugs into workable attacks
Wiz says the programming errors behind the vulnerabilities had been present in PHP’s code for more than a decade. Turning them into practical attacks, however, had previously been extremely difficult.
According to the company’s researchers, advanced AI models changed that. They were used to identify the vulnerabilities, build attack chains and adapt them to different PHP versions and server environments.
Wiz believes the development could have broader implications for cybersecurity. A vulnerability that previously required exceptional expertise and extensive manual work to exploit could become far easier to weaponise with the help of AI.
The company has named the group of vulnerabilities “PHP2Shell” and compares its potential significance to major vulnerabilities such as Heartbleed and Log4Shell.
The comparison is Wiz’s own assessment, but PHP’s widespread use means rapidly installing the available security updates is important in Finland and elsewhere.