Critical flaws in ubiquitous website software draw urgent warning from NSA, FBI

singchai nattapon/Getty Images

Organizations should imediately update to the latest version of PHP or take systems offline, agencies say.

Two critical flaws in software widely used in websites have the NSA, FBI, and Cybersecurity and Infrastructure Security Agency urging organizations to update their systems or take them offline immediately.

The vulnerabilities affect PHP, a programming language that works behind the scenes to run websites, process forms, and retrieve information. Hackers could exploit the flaws to run commands on an affected server without logging in, potentially allowing them to steal data, change a website’s contents, or take control of it.

PHP powers run roughly 70% of websites whose underlying server-side programming language can be identified, according to web technology tracker W3Techs . It is a key part of popular website-building platforms, including WordPress, Drupal, and Joomla.

Palo Alto Networks’ Unit 42 said it identified more than 22.6 million internet-exposed instances that might be vulnerable.

“While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched,” the cyberdefense agency said in a blog post .

A Nextgov/FCW analysis using Shodan, a search engine that catalogs internet-connected systems, identified roughly 900 results associated with U.S. federal, state and local government websites that showed signs of PHP use. Many listed older versions of the software, though it’s unclear if the records reflect the versions currently running on those systems, as Shodan may not yet have captured recent updates.

Governments in Europe have already been taking some websites offline to implement fixes .

“I’d expect a great deal of opportunistic exploitation: attackers don’t need to know what’s vulnerable before they start knocking on doors,” said Trey Darley, the founder of ProperTools, a cybersecurity standards consultancy. “Meanwhile, defenders can’t reliably count what they need to patch and protect.”

“Right now, the priority is protecting the systems people actually have,” he added.

The U.S. government was involved in coordinating the response ahead of disclosure. OpenAI said it and its partners engaged the White House’s Super Intelligence Force, the Office of the National Cyber Director and Cybersecurity and Infrastructure Security Agency to help security guidance reach organizations responsible for critical infrastructure and other essential services.

The flaws, collectively known as “php2shell,” affect the software beneath websites rather than a single website or application. That means an organization could have carefully secured its own code and still be exposed through the PHP software running it.

Cybersecurity company Wiz said it demonstrated successful attacks against WordPress, Drupal and Joomla installations. Researchers also showed they could read sensitive information from a server’s working memory, including passwords and access credentials.

PHP’s developers also said all installations handling web requests are at risk. Under certain setups, an attack can take place before the website’s own code even executes.

The discovery adds to evidence that AI is helping researchers find and exploit flaws in widely used software. OpenAI said security firm Calif identified a critical flaw using its GPT-5.6 Sol model, while Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the development and release of fixes.

PHP’s developers released updates Wednesday for supported versions of the software. They said organizations using Linux distributions or long-term support services should check their vendors for updated packages, including fixes adapted for older versions.

The warnings followed an early leak that accelerated plans to disclose and fix the vulnerabilities. A post on the technology forum Hacker News surfaced Tuesday morning and was subsequently removed, but screenshots spread across social media, according to cybersecurity firm Huntress . PHP’s developers then announced that fixes would arrive a day ahead of the planned disclosure, leaving website operators little time to prepare for updates.

Editor’s note: This story is breaking and may be updated.

NEXT STORY: Military power rising as power of diplomacy falling, diplomats, crisis monitors, allies say

singchai nattapon/Getty Images

各机构表示，组织应立即更新到最新版本的 PHP，否则应将系统离线。

由于网站广泛使用的软件存在两个重大缺陷，美国国家安全局、联邦调查局以及网络安全和基础设施安全局敦促各组织更新其系统或立即将其下线。

这些漏洞会影响 PHP，这是一种在后台运行网站、处理表单和检索信息的编程语言。黑客可以利用这些漏洞在不登录的情况下对受影响的服务器执行命令，从而窃取数据、更改网站内容或控制网站。

据网络技术追踪网站W3Techs的数据显示，在可以识别底层服务器端编程语言的网站中，大约70%的网站使用PHP。PHP是包括WordPress、Drupal和Joomla在内的热门网站建设平台的重要组成部分。

Palo Alto Networks 的 Unit 42 表示，他们发现了超过 2260 万个可能存在漏洞的互联网暴露实例。

“虽然截至发稿时，CISA 尚未发现这些漏洞被利用，但如果不进行修补，它们将对组织构成风险，”网络安全机构在一篇博客文章中表示。

Nextgov/FCW 使用 Shodan（一个收录联网系统的搜索引擎）进行分析，发现约有 900 个与美国联邦、州和地方政府网站相关的结果显示使用了 PHP。许多结果显示的是该软件的旧版本，但尚不清楚这些记录是否反映了这些系统当前运行的版本，因为 Shodan 可能尚未收录最新的更新。

欧洲各国政府已经开始关闭一些网站进行修复。

网络安全标准咨询公司ProperTools的创始人特雷·达利表示：“我预计会出现大量机会主义攻击：攻击者无需事先了解哪些系统存在漏洞，就可以开始发起攻击。与此同时，防御者也无法准确统计需要修补和保护的漏洞数量。”

“目前的首要任务是保护人们实际拥有的系统，”他补充道。

美国政府参与了信息披露前的应对协调工作。OpenAI表示，该公司及其合作伙伴与白宫超级情报部队、国家网络安全总监办公室以及网络安全和基础设施安全局合作，以确保负责关键基础设施和其他重要服务的机构能够及时获得安全指导。

这些漏洞统称为“php2shell”，它们影响的是网站底层软件，而非单个网站或应用程序。这意味着，即使组织精心保护了自己的代码，仍然可能通过运行该网站的 PHP 软件而受到攻击。

网络安全公司 Wiz 表示，他们成功演示了针对 WordPress、Drupal 和 Joomla 系统的攻击。研究人员还证明，他们能够从服务器的工作内存中读取敏感信息，包括密码和访问凭证。

PHP 的开发者也表示，所有处理 Web 请求的程序都存在风险。在某些配置下，攻击甚至可能在网站自身代码执行之前就发生。

这一发现进一步证明，人工智能正在帮助研究人员发现并利用广泛使用的软件中的漏洞。OpenAI 表示，安全公司 Calif 使用其 GPT-5.6 Sol 模型发现了一个关键漏洞，而 Wiz 则独立发现了这两个漏洞并进行了报告。PHP 的维护者主导了修复程序的开发和发布。

PHP 开发人员周三发布了针对受支持软件版本的更新。他们表示，使用 Linux 发行版或长期支持服务的组织应向其供应商咨询更新软件包，其中包括针对旧版本修复的补丁。

此前的一次泄露加速了漏洞披露和修复计划的制定，随后发出了警告。据网络安全公司Huntress称，周二上午，一篇发布在技术论坛Hacker News上的帖子被删除，但截图已在社交媒体上广泛传播。PHP的开发人员随后宣布，修复程序将在原计划披露日期前一天发布，这使得网站运营商几乎没有时间准备更新。

编者按：这是一则突发新闻，可能会有更新。

下一篇报道：外交官、危机观察员和盟友表示，军事力量正在崛起，外交力量正在衰落。