Líderes mundiales advierten sobre las fallas de seguridad encontradas en el lenguaje de programación PHP

Developers of the PHP programming language released urgent security fixes on Wednesday for two critical vulnerabilities that had persisted in the software for years. The flaws, identified through the use of artificial intelligence, allow attackers to execute remote commands on servers without authentication. In response to the threat, government agencies across Europe and other regions took websites offline as a precaution. Cybersecurity experts warned that the combination of a public fix and advanced AI tools capable of reverse-engineering the bug creates conditions for a rapid wave of intrusions. The vulnerabilities, collectively dubbed PHP2Shell, involve unauthorized access to memory areas within the PHP engine. This allows an attacker to run malicious code or read sensitive information stored in server memory. The US National Security Agency issued a rare public advisory urging organizations to prepare for immediate updates. The agency stated that the flaws provide direct paths to server file systems or databases and recommended disconnecting affected systems from the internet if patches could not be installed immediately. Spain’s national cybersecurity institute rated the severity of the issues at 9.2 on a scale of ten, describing them as critical. The discovery process highlighted a shift in cybersecurity dynamics driven by AI. Two independent security firms, Calif and Wiz, reported finding the flaws using large language models. Calif disclosed the first vulnerability on August 1, stating it utilized OpenAI’s GPT-5.6 Sol model during a review of the PHP codebase funded by OpenAI. Wiz, a subsidiary of Alphabet, reported the second vulnerability on August 24. Wiz stated it employed its autonomous AI tool, Wiz Atlas, along with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz noted that the underlying defects had existed for decades but required a complex chain of steps to prove exploitable, a task described as being at the edge of practical human capability. The firm characterized the findings as among the most severe discovered in PHP and possibly in software history. Calif and Wiz coordinated with the PHP team and OpenAI regarding the discoveries. The vulnerabilities remained hidden in the codebase for more than a decade. Before the advent of current AI capabilities, manually identifying and scaling exploitation of these specific flaws would have been exceptionally difficult. Wiz argued that AI removed this barrier, enabling researchers to test more attack vectors than human programmers could manage alone. OpenAI posted on social media that the error represents one of the most impactful security vulnerabilities in recent times and marks a phase where AI can identify flaws affecting the entire internet. The widespread nature of PHP amplifies the potential impact. The language, which originated in the early 1990s as an acronym for Personal Home Page, powers approximately 70 percent of websites globally. It is embedded in major content management platforms including WordPress, Drupal, Joomla, and Magento. Tiffany Farriss, interim chief executive of the Drupal Association, stated that all servers using any version of PHP released in the last twenty years are vulnerable. She described the issue as impacting the majority of the internet. Data from internet intelligence firm Censys indicated that roughly 1.5 million out of 2.6 million hosts reporting PHP usage run versions for which no fix is available. Government bodies reacted swiftly to mitigate risks. In Germany, the Federal Ministry for Digital Transformation and Government Modernization took several websites offline. France’s Ministry of the Interior deactivated official websites for local administrative offices. Authorities in Belgium, the Netherlands, Finland, and the Czech Republic also shut down sites to apply patches. The Dutch cybersecurity agency itself went offline as a precaution. In Switzerland, the canton of Basel-Stadt disabled its websites, while universities in Geneva and Lausanne became inaccessible. German federal authorities classified the risk level as extremely high, warning of massive disruption to regular operations. Japanese Prime Minister Sanae Takaichi posted on social media advising website owners to check if their live sites use PHP and to prepare to apply the new fix. The Dutch prime minister stated he was closely monitoring the situation. The White House confirmed it was made aware of the flaw on Friday. Amazon’s security chief, CJ Moses, revealed in a blog post that the company’s security team detected an attempt to exploit the vulnerabilities against a decoy honeypot system on October 17. This occurred four days before the public disclosure. Moses noted the attempt originated from an anonymous internet address, suggesting involvement by a threat actor, though it remained unclear how the actor accessed the information during the embargo period. Further attempts by multiple actors were recorded on Wednesday prior to the lifting of the embargo. Costin Raiu, co-founder of cybersecurity firm TLP:Black, described the situation as an AI-powered race to exploit. He predicted the next step would be the mass compromise of every vulnerable web server on the internet. The nonprofit PHP Foundation, which funds volunteer developers maintaining the language, labeled the flaws as among the most severe it had encountered. A security engineer for the foundation compared the incident to the Heartbleed bug of 2014, noting it was the most serious problem PHP had faced in over a decade. The foundation warned that AI tools now find bugs faster for both defenders and attackers, leading to a continuous increase in vulnerability reports. It called on technology companies to mount a coordinated response to prevent major disruptions to online services. Experts anticipate automated attacks occurring in rapid succession as hackers seek to gain an advantage over those applying updates.