The PHP2Shell vulnerabilities - which dominated news headlines and caused a host of services to be taken offline in a matter of hours - provide a case-study of the fragility of parts of the wider open-source eco-system.
PHP is a critical back-end programming language used to serve dynamic web pages. In broad terms, when you access a website, it interacts with other databases and systems to create a specific webpage tailored for you. It powers around 70% of the world’s websites including government services, online stores, banks, media sites, and much of the software that businesses and consumers rely on every day.
In 2024, the PHP Foundation – a non-profit collective or people and organisations with one full-time staff member - obtained funding for its first external security audit in years. This led to the identification of a potential out-of-memory (OOM) problem – this could allow malicious code to be inserted and executed as the system exhausts its memory. However, at the time there didn’t appear to be a way to turn that vulnerability into a workable exploit and any changes would have raised a host of compatibility and other issues. Work to fix the problem stalled because of a lack of resources and failure of the open-source contributors to agree a way forward.
This all changed with the arrival of increasingly capable frontier AI models. The PHP Foundation joined OpenAI’s Patch the Planet program and in less than 2 weeks a researcher identified the OOM vulnerability and a means to exploit it (and a second stale state vulnerability).
The vulnerabilities are extremely serious. They could, in some cases, allow threat actors to remotely execute code with no authentication, no session, and no vulnerable application code involved. As a result, the PHP team started work on the issue full time (eventually through weekends and around the clock) and planned to make a coordinated disclosure of the vulnerabilities and fixes.
However, an early leak disrupted that process. That led to a disorderly process with threat actors trying to exploit the vulnerability before it was patched. Following advice from cyber agencies, such as the UK National Cyber Security Centre, some organisations took their websites offline as a precautionary measure until a mitigation or full fix could be applied.
