The PHP security crisis: Here’s why you may have failed to reach some websites this week

By Leila Ugincius

Even for most of us who know little about computer coding, a name like JavaScript (or perhaps Python and C++) might ring a bell. But in the realm of coding languages, even fewer of us may have heard of PHP, which is in the news this week.

PHP, a language that tells servers how to process code, is used by nearly 70% of websites worldwide. This week, vulnerabilities discovered in PHP have been wreaking havoc on the internet. PHP’s security team released patches to fix the issue, but millions of websites went offline during the exposure.

At Virginia Commonwealth University, Lukasz Kurgan, Ph.D., is the Dean Robert J. Mattauch Endowed Professor in the Department of Computer Science in the College of Engineering. He answered some of VCU News' questions about the PHP crisis.

What are these vulnerabilities in PHP?

These vulnerabilities are in the code that implements the core functionality of the widely used PHP language, which is, in turn, utilized to build websites and other online-facing code. This means that they affect many, if not most, of the websites that we interact with daily.

They are known as the PHP2Shell vulnerabilities, and they originate in the foundational code that implements PHP. They allow unauthorized access to the computer running the flawed PHP codebase.

The fascinating aspect is that while a given website itself can be perfectly well-built and secure, these vulnerabilities still allow breaking into the computer on which it resides.

What dangers do the PHP vulnerabilities pose?

Skilled hackers can exploit PHP2Shell vulnerabilities to insert their code into a computer running the flawed PHP software – and even run it. This is particularly problematic for websites that host critical services and store sensitive data, as hackers can potentially disrupt or hijack these services and steal the data. The problem is so severe that some key websites were taken offline in recent days before a fix became available.

How can the PHP vulnerabilities be addressed?

The interesting part is that these vulnerabilities were originally discovered in mid-August and were kept secret until recently. There is nothing sinister about this secrecy, as this is meant to give time to build a fix before hackers find out. They were leaked to the public a few days ago, prompting an acceleration of efforts to fix them.

By now, they can be fixed by applying the PHP security updates posted on Oct. 21, but it will take some time for these patches to be applied. So, in the meantime, we can expect these vulnerabilities to create problems, especially since they are now so widely publicized.