World leaders warn against security flaw found in PHP computer programming

Authorities in Europe, Asia and other continents have temporarily taken some administration websites offline to protect against newly discovered security vulnerabilities in a programming language employed to power the vast majority of sites on the internet.

Key points

• In Germany, the Federal Ministry for Digital Transformation and Administration Modernisation stated it took some websites offline as a preventative measure.
• On Wednesday, vulnerabilities in the PHP programming language prompted a rare public warning from the United States National Security Agency (NSA).
• Authorities in Belgium, the Netherlands, Finland and the Czech Republic additionally stated they had shut down websites to apply a security patch to close the PHP loophole.
• Researchers at security firm Calif, working with OpenAI, documented the first flaw on August 11.
• Volunteers maintain the PHP programming language, and the nonprofit PHP Foundation remarked on Wednesday that the flaws were among the most severe it had encountered.

On Wednesday, vulnerabilities in the PHP programming language prompted a rare public warning from the United States National Security Agency (NSA). It advised taking websites offline if they could not be updated immediately.

"Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities, " the NSA remarked in a social media post.

In Germany, the Federal Ministry for Digital Transformation and Administration Modernisation stated it took some websites offline as a preventative measure. France's Ministry of the Interior deactivated the official websites for local administrative offices.

Authorities in Belgium, the Netherlands, Finland and the Czech Republic additionally stated they had shut down websites to apply a security patch to close the PHP loophole. Even Japanese Prime Minister Sanae Takaichi posted on social media to warn regarding the PHP risk.

Cybersecurity experts discovered the pair of vulnerabilities, dubbed PHP2Shell, with the support of artificial intelligence (AI) models.

Researchers at security firm Calif, working with OpenAI, documented the first flaw on August 11. Wiz, a security firm owned by tech giant Alphabet, documented the second vulnerability on August 24.

Wiz remarked the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history".

In practice, the underlying flaws had been present for decades, the firm remarked, but proving they were exploitable required a chain of steps "at the edge of what human researchers could practically achieve".

AI tools let researchers find vulnerabilities in software by testing more attacks than human programmers can alone.

For context, the group pressed anyone administering a website to update their code immediately.

Both flaws rely on accessing parts of memory without proper authorisation and exploiting that access to run malicious code. The two loopholes mean an attacker can remotely run commands on a server running old PHP code over the internet, without needing a password or legitimate account access.

Meanwhile, the PHP Foundation additionally cautioned that AI would create such security weaknesses easier to find. It called on tech firms to mount a coordinated response to avoid major disruptions to online services.

"Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing, " the foundation remarked in an official note.

In short, world leaders warn against security flaw found in PHP computer programming is the central thread here, and readers can expect follow-up reporting as the picture becomes clearer.