Two critical vulnerabilities in PHP, nicknamed “PHP2shell”, could let attackers run their own code on a web server without logging in.

PHP runs an estimated seven in 10 websites, including WordPress and Wikipedia. Some of the affected code dates back to 2012.

Timeline

  • 17 October: Amazon Web Services saw attempted attacks, possibly by a threat actor already aware of the bugs.
  • 21 October: The PHP Foundation issued a security alert.
  • 22 October: A fix was released, with the foundation urging everyone to update immediately.

The response in Australia

The Australian Signals Directorate issued a rare critical alert. GovCMS, the government’s website platform, blocked direct server access, and learning platform Moodle went offline temporarily.

Where AI comes in

A developer had first flagged one of the flaws in 2024. US security firm Calif later used OpenAI models to confirm it could be exploited.

Security researcher Troy Hunt told the ABC that Australians should expect more data breaches as a result, and that the only defence is to patch very quickly.