Government websites across Europe went dark overnight as operators scrambled to patch two critical vulnerabilities in PHP, one of the most widely used programming languages on the web, prompting fresh warnings from security researchers at Sophos.
PHP runs nearly 70 per cent of all websites whose programming language can be identified, and powers WordPress, the software behind roughly 40 per cent of all websites, including blogs, small business pages, government portals, online shops and news sites.
Finding every instance of PHP is the hard part
“The immediate challenge is not simply installing a patch, but finding and managing every instance where PHP is running. The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it,” said Don Smith, vice-president of threat intelligence at Sophos Counter Threat Unit.
Smith said security teams should prioritise internet-facing systems, confirm which versions are affected once the official advisory is published, and apply updates without delay, isolating any vulnerable system that cannot be patched. He warned that threat actors, aided by AI, are likely to make the vulnerability a priority target in the coming hours and days.
AI is accelerating the race to exploit new flaws
“Our research backs up what others are confirming, that these techniques can be used to predictably corrupt memory and bypass some implementation of ASLR protections in PHP. With AI accelerating the weaponisation process, attackers can potentially move to working exploits much faster, leaving defenders with an increasingly narrow window to respond,” said Chris Yule, senior director of threat research at Sophos Counter Threat Unit.
Yule said the harder problem lies with older systems and appliances running vulnerable versions of PHP that cannot easily be updated or replaced, particularly where organisations have limited visibility into patch levels and depend on vendors for updates. Organisations that cannot identify where affected systems are still running risk attackers finding them first, he said.
