PHP’s ‘security hole’ leaves websites worldwide exposed to hacking [Websites worldwide on high alert over hacking]

It was confirmed on the 21st (local time) that PHP, the technology powering up to 75% of websites worldwide, has a critical security flaw. Security researchers discovered the vulnerability using artificial intelligence (AI).
The Wall Street Journal (WSJ) reported that developers of PHP, a programming language widely used in website development, discovered a critical security flaw that day while using AI. Hackers could take control of any system running PHP software, and the developers urgently released a new version that day with fixes for two critical vulnerabilities.
Hackers are reportedly able to exploit the flaw to remotely run arbitrary code or take over a system without any separate login or authentication process.
The security flaws discovered this time, dubbed ‘PHP2Shell,’ are a series of defects stemming from the way PHP manages computer memory. Hackers can exploit them to run unauthorized software on web servers. The impact is significant: some attacks can be completed in seconds.
According to W3Techs, a web technology analytics firm, about 75% of websites worldwide whose programming language can be identified are built with PHP. WordPress, a blogging and website-building tool used by about 43% of all websites worldwide, also runs on PHP.
Cutting-edge AI succeeded in finding, in an instant, a critical security flaw hidden in code that humans had failed to notice for more than a decade. A security researcher had previously warned of the risk, but it was deemed too difficult to turn into a real-world attack with the technology available at the time and was forgotten. The WSJ explained that AI has broken through that barrier.
Volker Duse, a security engineer at the nonprofit foundation that manages the PHP project, called the incident “the most serious security problem PHP has faced in more than a decade” and compared it to Heartbleed, a major security crisis that once threatened hundreds of thousands of servers.
The problem is that today’s AI tools can perform this task much faster than humans. Thai Duong, CEO of security firm Calif, which first discovered the vulnerability, warned, “The moment someone on X (formerly Twitter) feeds the patch code into AI, runs it to create an exploit script, and posts it, tremendous chaos will ensue.”
The security patch had initially been scheduled for release on the 22nd, but news about it leaked through a post on Hacker News on the 20th, and the patch was ultimately released on the 21st.
[email protected] Song Gyeong-jae Reporter