Two critical PHP flaws trigger global alert; millions of services face cyber risk

BENGALURU: Two critical PHP vulnerabilities that could allow hackers to remotely execute code on servers without authentication have triggered a cybersecurity alert, potentially exposing millions of internet-facing services. In a separate advisory, PHP also urged users to temporarily disable a file-upload tracking feature to mitigate another remote code execution risk, adding to concerns over the widely used programming language.PHP advised users on Oct 23 to temporarily disable its session upload progress feature until the next regular bugfix release.

The warning followed an earlier advisory on Oct 21 about a related vulnerability. The latest issue affects applications only when specific session settings are changed while running and the upload progress feature remains enabled. Users who have already disabled the feature do not need to take further action.The broader concerns centre on two critical vulnerabilities collectively referred to as PHP2Shell.

Aamir Lakhani, global director of threat intelligence and adversarial artificial intelligence research at Fortinet, said: “Two critical PHP vulnerabilities disclosed this week pose an urgent security and business continuity risk for organizations that depend on websites, customer portals, and other web applications.”PHP is a server-side programming language used by widely deployed platforms such as WordPress, Drupal, Joomla and Magento.

Companies can be exposed through commercial applications, hosting providers and embedded software components even if they do not develop PHP applications themselves.The potential scale of exposure is significant. Censys identified approximately 36.7 million internet-facing services reporting potentially affected PHP versions in its Oct 22 snapshot. These are service counts, not unique servers or organisations, and may include installations already patched through vendor updates.Saeed Abbasi, head of the Threat Research Unit and director of product at Qualys, said the company found 167 million PHP package installations across 12,000 organisations, with 73% deployed on internet-facing assets, putting them within reach of remote attackers.

“Applying a patch alone will not be sufficient for systems running unsupported versions, where upgrading is the only viable long-term solution. The key takeaway is that nearly all PHP installations are either vulnerable or running unsupported versions,” he said.CloudSEK said Shodan identified 2.2 million internet-facing services displaying PHP information worldwide, with India ranking ninth at 53,400 services.

Of 36,700 Indian services revealing their PHP versions, about 36,100 were unpatched, including 19,500 running versions that have reached end of life, said Akash Karthi, a security researcher at CloudSEK.You use AI every day. Now get your AI Quotient. Take the AIQ test.