Technology 3 min read By Alice Ashford
Unpatched PHP flaws prompted a rare cyber-storm alert that most media ignored
A rare SANS threat-level alert over the PHP2Shell flaws drew little national coverage, even as AI tools rapidly turned patches into working attacks on widely used web servers.
A rare cyber-storm alert issued last month over two flaws in PHP, the scripting language behind a large share of the world's websites, received little attention from national news outlets, despite warnings from security agencies that some systems should be taken offline immediately. The SANS Internet Storm Center raised its threat level, the first such increase since December 2021 and one of only ten since 2010, according to SANS records.
The flaws, dubbed PHP2Shell, allow an attacker to take over a web server. PHP powers roughly 70 per cent of websites whose programming language is known, and the vulnerabilities are believed to have existed since at least 2012. A researcher working with an OpenAI model found them. The PHP maintainers released a patch on 21 October, but attacks were already under way by then. Finland took government websites offline in response, and the Dutch parliament's website went dark. The US National Security Agency and the UK's National Cyber Security Centre urged organisations to pull systems that could not be fixed off the network without delay.
The episode highlights a growing problem: artificial intelligence can now turn a published patch into a working exploit within hours. A separate Linux network-handling flaw was fixed on 5 October, and on 27 October an exploit for it was written by Anthropic's Claude. As of 2 November, Ubuntu, a major server version of Linux, had still not been patched against that flaw.
Patching has lagged well behind the threat. Qualys counted 167 million PHP installations on its customers' systems, yet only about one in 1,000 was updated within 12 hours of disclosure. Delays can stretch to weeks, leaving a wide window for attackers.
The gap is not new. The 2017 Equifax breach, which exposed data on 147 million Americans, was carried out through an unpatched flaw in the Apache Struts framework between March and May that year. The author's study of media coverage found that no tracked national outlet reported on the Struts patch at the time.
Coverage of the PHP2Shell window was not much better. Across CNN, Fox, NPR and USA Today, 5,610 stories ran during the period studied. Only nine mentioned PHP2Shell or other major flaws, and two of those did so in headlines. Of the ten SANS-flagged events between 2010 and 2021, six received no median national story at all.
The scale of the problem is growing. The week of 12 October saw a record 5,461 software vulnerabilities published, more than fifteen times the 2020 weekly average. The author urges the US Cybersecurity and Infrastructure Security Agency to introduce a public watch-and-warning system, and proposes that newsrooms treat such warnings in the way they cover product recalls. The incoming Congress, the author argues, will need to weigh the pace of AI development, agency funding and liability for unpatched systems.
Source: fortune.com
13
