PHP2Shell flaws can give unauthenticated control of website servers
Original title: Hackers got a four-day head start on epic PHP2Shell vulnerability
Calif and Wiz found the bugs; OpenAI helped PHP develop patches, and the NSA urged taking unpatched systems offline.
Researchers at Calif and Wiz discovered PHP vulnerabilities that the UK NCSC said could let a hacker control a website server without a password. OpenAI said it worked with PHP, Calif and Wiz to verify the flaws and develop patches, and that frontier AI found them before attackers. The NSA advised taking systems offline if an immediate update is not feasible. The White House said agencies were assessing effects on government systems and critical infrastructure.
Unconfirmed: OpenAI says frontier AI found the flaws before attackers, while the headline says hackers had a four-day head start.
- Wiz estimated the affected language powered about 70 percent of websites.
- WordPress, written primarily in PHP, is cited as a reason for PHP’s reach.
- The NCSC is encouraging UK organizations to take immediate action.
- OpenAI called it one of the most impactful recent security issues.
Impact: Unauthenticated control of a website server
| Product | Affected |
|---|---|
| PHP | — |
- 1.Apply the PHP patches developed with OpenAI, Calif and Wiz.
- 2.Take affected systems offline if an immediate update is not feasible.
- Vendors
- PHP
- Products
- WordPress
- Countries
- United StatesUnited Kingdom
From the original article
1 min read at arstechnica.com
Hackers were already probing the bug before defenders were told it existed.
By Tom Wilson and Rafe Rosner-Uddin, Financial Times · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.