One of the biggest security scares to hit the web is causing widespread disruption, prompting businesses, hospitals, schools, and government agencies to temporarily shut down websites and online services as they scramble to protect themselves against two critical vulnerabilities in PHP, the programming language underpinning much of the internet.

The vulnerabilities, collectively dubbed PHP2Shell, could allow unauthenticated attackers to execute malicious code on affected servers. Major technology companies have been racing to protect users, with Cloudflare deploying firewall protections and Automattic confirming that websites hosted across its platforms, including WordPress.com, WordPress VIP and Tumblr, have been secured. The Wikimedia Foundation, meanwhile, took several supporting services offline until they can be patched.

The PHP project released emergency fixes on Wednesday for versions 8.2 through 8.5. Older versions are no longer officially supported, although some distributions and vendors provide legacy fixes, and PHP has published limited patches for versions 7.4 through 8.1.

But while the PHP vulnerabilities are a major deal in their own right, the circumstances surrounding their discovery, remediation, and disclosure offer a revealing glimpse into the growing pressures facing the open-source community, as AI makes it easier to uncover serious security flaws.

News of the impending patches emerged on Tuesday , after details leaked ahead of their scheduled disclosure. 6 Sol model , while Google-owned Wiz had independently identified both vulnerabilities. OpenAI said it spent two months coordinating a response involving PHP maintainers, the security researchers, Cloudflare, and government cybersecurity agencies, as part of its Patch the Planet initiative .

Source link