The PHP development team has identified two critical security vulnerabilities in the language, scoring them a severity of 9.2 out of 10. According to the Federal Office for Information Security (BSI), numerous popular open-source projects-including WordPress, Drupal, Typeo3, Joomla, Magento, Nextcloud, pfSense, and OPNsense-are built using PHP. WordPress alone indicates that over 40 percent of all websites on the internet use the content management system, making a vast number of sites exposed. Due to these risks, several websites, including those of German authorities, municipalities, and various institutions, were preemptively taken offline on Wednesday.
PHP’s security team released a security update around 4 PM on Wednesday, noting that there is no complete solution against the vulnerability, and that applying the update is the only safe recourse. All PHP users are urgently advised to install the update immediately. Furthermore, a proven exploit for the flaw is already available.
The BSI warned that attackers could exploit vulnerabilities in such widely used programming languages or libraries to execute massive campaigns and compromise IT systems across various application areas. They deemed a wide-scale exploitation of the vulnerability likely within hours of the patches being released. The BSI stressed that with the emergence of AI-supported tools for exploit development, actors now possess the resources to analyze patches and generate exploits in a very short timeframe. Therefore, IT security managers must act without delay.
Felix Kuhlenkamp, Head of Security at the digital association Bitkom, urged anyone running online applications to check if they utilize PHP, and if so, to install the forthcoming security updates without any delay. He particularly targeted hosts and IT service providers who manage systems for multiple clients. Kuhlenkamp also advised companies to audit their entire IT infrastructure to locate every instance of PHP, including older versions that are no longer receiving updates, pointing out that many organizations do not precisely know which components are embedded in their software. However, having this overview is crucial for rapid response in such situations.
Kuhlenkamp referenced past incidents, such as the vulnerabilities discovered in the widely used Microsoft Exchange email server in 2021 and the Log4Shell flaw in a software component used in countless applications toward the end of that year. In both of those instances, criminals searched worldwide for vulnerable systems within hours. He concluded that today, finding vulnerable systems using the assistance of AI is likely to be exponentially faster.
