Up to 70% of the world’s websites could be at risk after AI researchers uncovered PHP2Shell, a critical security flaw in PHP, according to the Wall Street Journal. The flaw could let hackers hijack unpatched servers, steal sensitive information and launch attacks against website visitors.
PHP is a programming language widely used by WordPress, government portals and e-commerce websites. Two of the reported vulnerabilities carry a severe rating of 9.2 out of 10. They could allow attackers to remotely run malicious code without authentication.
Several European governments have already acted. Finland shut down state internet services over the security flaws. In the Netherlands, the national cybersecurity agency took its own website offline. France temporarily closed its prefecture websites until security fixes can be applied.
Cloudflare ($NET) has reported early attacks linked to the flaws. The company says its protective changes are now live. Emergency patches were released a day early after details of the vulnerabilities leaked.
The biggest concern is the role of artificial intelligence. AI could speed up the development of exploits. That could let hackers weaponize the vulnerabilities before millions of websites are secured.
EU cybersecurity officials are urging immediate patching of affected systems. They have also advised website operators to take vulnerable sites offline if the fixes cannot be applied.
