World leaders warn of security flaws found in PHP programming language

Artificial intelligence was used to pinpoint two vulnerabilities in the PHP programming language, used by more than 70 percent of websites.

A keyboard is placed in front of a displayed OpenAI logo in this illustration taken on February 21, 2023 [File: Dado Ruvic/Reuters]

Authorities in Europe, Asia and other continents have temporarily taken some government websites offline to protect against newly discovered security vulnerabilities in a programming language used to power the vast majority of sites on the internet.

On Wednesday, vulnerabilities in the PHP programming language prompted a rare public warning from the United States National Security Agency (NSA), which advised taking websites offline if they could not be updated immediately.

list 1 of 3 Scientists urge tighter AI controls to prevent global cyber risks

list 2 of 3 Israeli ad-tech firm helped place spyware on Al Jazeera devices

list 3 of 3 How Israeli firm’s ‘zero-click’ malware attack poses global security risk

“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities,” the NSA said in a social media post.

In Germany, the Federal Ministry for Digital Transformation and Government Modernisation said it took some websites offline as a preventative measure. France’s Ministry of the Interior deactivated the official websites for local administrative offices.

Authorities in Belgium, the Netherlands, Finland and the Czech Republic also said they had shut down websites to apply a security patch to close the PHP loophole. Even Japanese Prime Minister Sanae Takaichi posted on social media to warn about the PHP risk.

Cybersecurity experts discovered the pair of vulnerabilities, dubbed PHP2Shell, with the help of artificial intelligence (AI) models.

Researchers at security firm Calif, working with OpenAI, reported the first flaw on August 11. Wiz, a security firm owned by tech giant Alphabet, reported the second vulnerability on August 24.

Wiz said the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history”.

The underlying flaws had been present for decades, the firm said, but proving they were exploitable required a chain of steps “at the edge of what human researchers could practically achieve”.

AI tools let researchers find vulnerabilities in software by testing more attacks than human programmers can alone.

Volunteers maintain the PHP programming language, and the nonprofit PHP Foundation said on Wednesday that the flaws were among the most severe it had encountered.

The group urged anyone administering a website to update their code immediately.

Both flaws rely on accessing parts of memory without proper authorisation and exploiting that access to run malicious code. The two loopholes mean an attacker can remotely run commands on a server running old PHP code over the internet, without needing a password or legitimate account access.

The PHP Foundation also warned that AI would make such security weaknesses easier to find. It called on tech companies to mount a coordinated response to avoid major disruptions to online services.

“Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing,” the foundation said in a statement .

人工智能被用于精确定位 PHP 编程语言中的两个漏洞，而超过 70% 的网站都在使用 PHP 编程语言。

这张摄于 2023 年 2 月 21 日的插图显示，键盘放置在 OpenAI 标志的前面。[图片：Dado Ruvic/路透社]

欧洲、亚洲和其他大洲的政府机构已暂时关闭了一些政府网站，以防止在用于驱动互联网上绝大多数网站的编程语言中新发现的安全漏洞。

周三，PHP 编程语言中的漏洞促使美国国家安全局 (NSA) 罕见地公开发出警告，建议如果网站无法立即更新，则应将其下线。

科学家呼吁加强人工智能管控，以防止全球网络风险（共3条，第1条）

以色列广告技术公司帮助在半岛电视台设备上植入间谍软件（共3项，此为第2项）

以色列公司“零点击”恶意软件攻击如何构成全球安全风险（共3条，此为第3条）

美国国家安全局在社交媒体上发帖称：“即日起，所有在其系统中使用 PHP 的组织都应做好准备，迎接一项旨在解决两个关键漏洞的更新。”

德国联邦数字化转型和政府现代化部表示，已将部分网站下线作为预防措施。法国内政部也停用了地方行政部门的官方网站。

比利时、荷兰、芬兰和捷克共和国的有关部门也表示，他们已关闭部分网站，以便安装安全补丁来修复PHP漏洞。就连日本首相高市早苗也在社交媒体上发文，警告公众注意PHP漏洞的风险。

网络安全专家借助人工智能（AI）模型发现了这两个漏洞，并将其命名为 PHP2Shell。

安全公司 Calif 与 OpenAI 合作的研究人员于 8 月 11 日报告了第一个漏洞。科技巨头 Alphabet 旗下的安全公司 Wiz 于 8 月 24 日报告了第二个漏洞。

Wiz 表示，这些发现“堪称 PHP 中最严重的漏洞之一，甚至可以说是软件史上最严重的漏洞之一”。

该公司表示，这些根本缺陷已经存在了几十年，但要证明它们可以被利用，需要一系列步骤，“这几乎达到了人类研究人员实际能够达到的极限”。

人工智能工具可以让研究人员通过测试比人类程序员单独能测试的更多的攻击来发现软件中的漏洞。

PHP 编程语言由志愿者维护，非营利组织 PHP 基金会周三表示，这些缺陷是他们遇到的最严重的缺陷之一。

该组织敦促所有网站管理员立即更新其代码。

这两个漏洞都依赖于未经授权访问内存，并利用这种访问权限运行恶意代码。这两个漏洞意味着攻击者可以通过互联网远程向运行旧版 PHP 代码的服务器执行命令，而无需密码或合法账户访问权限。

PHP基金会也警告称，人工智能将使此类安全漏洞更容易被发现。该基金会呼吁科技公司采取协调一致的应对措施，以避免在线服务出现重大中断。

该基金会在一份声明中表示：“如今，无论对于防御者还是攻击者来说，工具都能比以往任何时候都更快地发现漏洞，而且报告的数量还会继续增长。”