The Indian Computer Emergency Response Team (CERT-In) has issued a critical-severity warning following the discovery of two significant security vulnerabilities in PHP, the widely used open-source scripting language that powers a vast array of websites and web applications globally. The agency has cautioned that these flaws could potentially allow unauthenticated attackers to remotely execute malicious code, disclose sensitive memory data, and compromise entire systems.
In an advisory released on Wednesday, CERT-In confirmed that large-scale exploitation of these vulnerabilities is already occurring in the wild. The agency has urged all organizations and individual users running affected versions of PHP to apply security updates immediately to mitigate the risk of system infiltration.
The scale of the incident has sent shockwaves through the global technology sector. Microsoft CEO Satya Nadella, speaking at an event in Cologne, Germany, described the nature and reach of the incident as highly unusual, stating that he had not witnessed a situation of this magnitude in a long time. The urgency of the response stems from the fact that the vulnerabilities were reportedly leaked prior to their official disclosure date, giving malicious actors a head start in developing exploit payloads.
Google Cloud executives, including Chief Information Security Officer Chris Betz and head of Gemini Security at Google DeepMind, Raluca Ada Popa, noted that the vulnerabilities were disclosed by the PHP team alongside the cybersecurity firm Wiz Research. The research involved the use of multiple AI models to identify and remediate the security gaps. While Google Cloud confirmed that its own core infrastructure remains unaffected, it warned that customers hosting PHP applications on its platform may be exposed. The company is actively assisting clients by rolling out updated serverless base images for supported PHP runtimes and facilitating automatic updates for specific service configurations.
The impact of the disclosure has been immediate and international. Cloudflare CEO Matthew Prince reported on social media that the company observed thousands of attempts to exploit the vulnerabilities within just ten hours of their public announcement. Cloudflare’s internal monitoring systems tracked how attackers dynamically modified their payloads in real-time, attempting to bypass security filters. Consequently, the company successfully deployed mitigations to protect its client base.
In response to the heightened risk, government agencies and various private organizations across multiple countries have adopted a cautious approach, temporarily restricting access to specific online services. These measures were taken as a preventative step while IT teams worked to patch systems and conduct vulnerability assessments. The global scramble highlights the critical nature of maintaining open-source components that form the backbone of the modern internet.
Users and administrators are advised to monitor official channels for further updates and ensure that all PHP-based applications are redeployed with the latest patches. As the situation remains fluid, security experts emphasize the importance of urgency in patching, given that the threat is not limited to a single geography or sector but poses a broad risk to any entity utilizing the affected software versions.
Comments