PHP: Critical Vulnerability, Site Withdrawals, and Hacker Rush

A critical vulnerability in PHP has led to emergency patches and temporary site withdrawals. Massive exploitation attempts have been reported, while the discovery by researchers linked to OpenAI and Wiz reignites the debate on large-scale disclosure in the era of LLMs. The scale of PHP in web infrastructure complicates the fix for many stakeholders.

Massive Attempts, Site Withdrawals, and Fear of Access Loss

Matthew Prince, CEO of Cloudflare, reported a significant increase in hacking attempts related to PHP2Shell, with millions of attempts observed. According to Sean O’Kane, governments have withdrawn sites, and heavily trafficked platforms have been temporarily taken offline to implement necessary patches. 404 Media highlighted the risk of link degradation as a consequence of site closures decided for security reasons. Kirsten Korosec emphasizes that these withdrawals can render small parts of online history inaccessible when the fix is not immediate.

An Old and Ubiquitous Web Foundation Exposed

PHP is the engine behind content management systems like WordPress and Drupal, which account for about 70% of websites. This open-source language, used for decades, is an essential part of the infrastructure of websites, sometimes without site administrators being fully aware. Its central role in building the web makes it a structural vulnerability point. The scale of the phenomenon, mentioned in tens of millions of sites, fuels concerns about the extent of the potential impact.

Discovery by Hack the Planet and Urgency to Fix

The vulnerabilities were identified by human researchers as part of the Hack the Planet initiative, led by OpenAI and Wiz. Artificial intelligence was used to exploit the discovered bug. An alert was issued, urging site owners to fix the issue immediately or, failing that, to temporarily withdraw their sites due to the severity of the flaw. The urgency is justified by the fact that if some can detect the vulnerability, others can too. It is also noted that this flaw has existed in PHP for decades.

Large-Scale Disclosure: Criticism, Embargo, and Procedures

Criticism has emerged regarding how the disclosure was conducted, with some pointing to hype and embargo breaches that may have accelerated the attackers' race. Typically, a flaw is reported to the publisher in a restricted setting, but the global dissemination of such a fundamental component complicates discreet alerts. The difficulty in identifying unique technical responsible parties is mentioned, as is the still-hypothetical idea of using AI agents for large-scale notifications. The situation is described as a new frontier in cybersecurity, which will lead to many back-and-forth discussions on disclosure methods.

LLMs and AI Agents: Potential Accelerator and Coordinated Hunt

Sean O’Kane indicates that teams from Google and OpenAI have been mobilized to identify vulnerabilities, including those affecting PHP. The discussion links widespread access to language models and AI agents to a possible acceleration in vulnerability discovery. LLMs are now widely used, and Wiz, involved in the Hack the Planet initiative, is now part of Google. Anthony Ha also mentions the use of language models in vulnerability research.

Unequal Defense Capabilities and Industry Pathways

Kirsten Korosec reports that Amazon observed, via a network of honeypots, exploitation attempts before the public announcement, illustrating advanced monitoring capabilities. She emphasizes that many sites, including potentially government sites, do not have such means, and estimates that the scale of the problem exceeds what can currently be resolved. She anticipates more extreme behaviors from some AI professionals and questions the emergence of startups or the use of open-source tools, particularly those offered by Nvidia, to enhance security. Meanwhile, Sean O’Kane notes that actors are already seeking to exploit these vulnerabilities.