PHP2Shell: Govts on high alert over critical website flaw; what users should know
A critical security vulnerability in PHP, dubbed 'PHP2Shell', has forced governments and major websites worldwide to take systems offline for patching. The flaw, discovered via AI, allows unauthorized remote access to servers.
Why it matters
Because PHP powers a vast majority of the internet, this vulnerability poses a significant threat to global digital infrastructure and data security.
A large chunk of the internet went offline on Wednesday, and most of it was switched off on purpose. Government websites in the Netherlands, Finland, France and Denmark, along with universities, hospitals and sites as big as Wikipedia, pulled systems down after two serious security flaws were found in PHP. Most people have never heard of PHP, but it is the software running behind roughly 70% of all websites, from news sites and online shops to personal blogs.The flaws, now nicknamed PHP2Shell, let a hacker take over the computer that runs a website without needing a password. They had been hiding in PHP's code for more than a decade, and it took artificial intelligence (AI) to find them. PHP's developers released a fix on October 21, but hackers moved within hours to attack websites that hadn't updated yet.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in