Critical PHP Vulnerabilities Under Active Exploitation by Hackers

PHP Vulnerabilities Threaten Global Web Servers

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning, reporting that two critical vulnerabilities discovered in PHP software are now being actively exploited by hackers. US federal agencies have been ordered to update their systems within three days to prevent potential intrusions and data leaks.

PHP is one of the most widely used programming languages, powering approximately 70% of internet servers. These vulnerabilities allow hackers to gain remote access to systems without requiring a password. Given the severity of the threat, many large organisations and government bodies have already temporarily taken their websites offline to bolster security measures.

The Role of AI in Cyberattacks

Interestingly, these vulnerabilities, known as PHP2Shell, have existed in the source code for years. Initially, experts believed they were practically impossible to exploit, and therefore they were not considered a priority threat. However, the situation changed after researchers at security firm Calif used artificial intelligence models to discover an effective way to exploit these weaknesses.

This case clearly demonstrates how artificial intelligence increases the risk of cybercrime. AI models can identify weak points that remain unnoticed by humans or combine several minor flaws to carry out larger-scale attacks. This trend is particularly alarming for older, open-source technologies that often lack the funding for regular, in-depth security audits.

What Should System Administrators Do?

Although CISA's directive specifically applies to US federal agencies, the recommendation is universal: any organisation or web developer using PHP must immediately install the latest software updates. The creators of PHP have already released the necessary patches, yet systems remain vulnerable on servers where the update process has not been carried out in a timely manner.

For companies operating in the digital space in Georgia, this serves as another reminder that outdated software poses a serious risk in the current cybersecurity landscape. It is recommended to audit server infrastructure and prioritize the installation of all critical updates to avoid potential attacks carried out through automated tools.