A vulnerability in the PHP programming language has disrupted the Internet. What you need to know

Critical vulnerabilities have been found in the PHP programming language, which is used for most websites. Information about this appeared before its official publication, which led to millions of attacks on web pages. The PHP developers released an update to resolve the issue, but this did not prevent numerous service failures around the world. How serious the situation is and what threats have arisen is in the Izvestia article.

What is PHP?

PHP is one of the most widely used programming languages in the world, which can be called the foundation of a significant part of the modern Internet. It is supported by most hosting providers and is actively used to create web pages. According to existing estimates, 72% of sites for which a server-side programming language is known run on the PHP core.

• The creator of PHP is the Dane Rasmus Lerdorf. In 1994, he wrote commands to track visits to his online resume and called them "Personal Home Page Tools" (PHP Tools for short). Over time, the blank for personal use turned into a full-fledged programming language.

• In 1998, PHP version 3 was released, which became a convenient tool for creating web pages. At the same time, its name began to stand for PHP Hypertext Preprocessor ("PHP Hypertext preprocessor"). PHP has gone through several major updates, and its current, eighth version was released in November 2020.

AI giants will develop industry safety standards. What is the threat to the market

• PHP is a public open source project, meaning as a language it is not owned or controlled by any company. A group of enthusiastic developers who raise funds for their work through sponsors is engaged in the development of PHP, its updates and the development of its standards.

What problems are there with PHP?

• On October 20, it became known that there are two vulnerabilities in the PHP core, collectively known as PHP2Shell. One of them is related to an error in processing out of memory, which can lead to memory corruption of the request and the execution of malicious code. The second vulnerability exploits a "use after release" type error, when one request leaves data in memory, and the next request, processed by the same workflow, uses it.

• Together, both vulnerabilities have received a critical level of danger — 9.2 out of 10 points on the CVSS v4.0 scale. They allow for unauthorized remote code execution, meaning attackers do not need login credentials to gain control of a PHP-based server.

• Vulnerabilities potentially affect all versions of PHP, starting with the fifth, released back in 2004. The language development team promptly released fixes and urged all users to update PHP urgently, and before installing patches, temporarily isolate vulnerable applications and pages from public networks. If an unsupported version of PHP is being used for which an update has not been released, the developers advised to upgrade to another version immediately.

How the vulnerabilities were discovered

• PHP2Shell vulnerabilities were discovered back in August thanks to research using artificial intelligence. They were conducted by two independent teams within the framework of the OpenAI project called Patch the Planet. It was launched to find bugs in open source software using AI tools.

• The discoverer of the vulnerabilities was programmer Ryan Austin from the company Calif. He used the GPT-5.6 Sol model to search for errors. His conclusions about the dangers of PHP were confirmed by researchers from Wiz, who used Google's Gemini 4 Argon along with their own developments. In their conclusion, they noted that one researcher managed to complete such a volume of work in a week that, if manually processed, would require a month's effort from the whole team.

• Vulnerabilities have existed for a dozen years, and all this time they could not be recognized using manual security audits. After the errors were discovered, PHP developers began to compile fixes, but due to information leaks, patches had to be urgently released on October 21, although the initial publication was supposed to take place later.

How serious is the situation

• The PHP team assessed the incident as the most serious threat to PHP in the last decade. Shortly before the problem was recognized and patches were released, the first attempts to exploit vulnerabilities occurred, and after they became publicly known, there was an explosive increase in attacks. Cybersecurity company Cloudflare reported millions of hacking attempts three hours after the information was leaked.

The AI model organized an "uprising" and a cyber intrusion without a team. Why is this important?

• Due to the fact that the problem affects the PHP core, a huge range of sites and services are at risk. Many organizations had to turn off their resources to install updates, and this led to disruptions. The vulnerabilities primarily affected sites built on WordPress, Drupal, Joomla, and Magento management systems. Users complained about failures of Wikipedia and the Internet Archive library.

• Government websites in the Netherlands, France, Finland, Denmark and other countries were also affected by the outages. A serious blow fell on Japan, where the websites of banks, the airline ANA and the railway operator were disabled. After troubleshooting, the pages returned to work. At the same time, millions of sites that have not been updated remain vulnerable to attacks that can take place using artificial intelligence, which increases their effectiveness and scale.