PHP: The three letters that shut down sites all over the internet today
Posts from this topic will be added to your daily email digest and your homepage feed.
TL;DR
- Two critical vulnerabilities in the PHP programming language were discovered using AI.
- These flaws allow for unauthenticated remote code execution, enabling attackers to take control of servers.
- Major websites (4chan, Wikipedia) and government agencies took sites offline as a precaution.
- The vulnerabilities have existed for approximately 20 years but were difficult to exploit until AI made it easier.
- AI models, including GPT-5.6 Sol, were involved in identifying the flaws.
- Exploiting these vulnerabilities could lead to attackers gaining access to sensitive data, executing code, and attacking other servers.
- Website owners are advised to update to fixed PHP releases, and those using unsupported versions (PHP 8.1 and older) should upgrade.
- Users of managed hosting services should check with their providers for patch deployment timelines.
- Disabling sites until hosts patch PHP is recommended for those with sensitive data.