PHP vulnerabilities expose the risks of hidden dependencies

Government websites, news sites and other online services have temporarily been taken offline because of two critical vulnerabilities in PHP. Developers of the widely used programming language have since released security updates. However, organisations are not immediately out of danger. IO+ spoke with Georgios Smaragdakis, professor of cybersecurity at Delft University of Technology (TU Delft), and Patrick Jordens of cybersecurity company The Trusted Third Party about the vulnerabilities and the risks they pose.

PHP is used worldwide for web development. The programming language underpins, among others, websites running on WordPress, Drupal and Joomla.

“The problem is that many of these popular applications are used by virtually everyone,” says Smaragdakis. “If you rely on just one technology and something goes wrong with it, everything can collapse.”

A vulnerability hidden for decades

Research team Wiz Research discovered the vulnerabilities and describes how AI models helped expose flaws that had remained hidden in PHP code for years. Exploiting the vulnerabilities required a complex sequence of steps. AI helped researchers overcome that technical barrier.

According to Patrick Jordens, part of the problem lies in how organisations depend on PHP without realising it. PHP runs underneath platforms such as WordPress, Drupal, Joomla and Magento. The programming language is inexpensive, widely available and easy to build with. “Almost nobody knows they are using it. You don’t buy PHP; you buy a website, an online shop or a customer portal. And you can’t manage a risk you can’t see.” As a result, a single vulnerability can affect many organisations at once, Jordens says.

The vulnerabilities affect PHP itself, rather than individual websites or applications built with the language. This means that even websites with secure application code may be at risk. The flaws could allow attackers to execute code remotely on a server or read sensitive data from its memory. This could expose passwords, access keys and other confidential information.

Millions of servers run outdated PHP

According to Smaragdakis, measurements have identified more than four million servers worldwide that use PHP. An estimated 60 to 70 per cent run versions that have reached end of life and no longer receive regular security updates.

Outdated software often remains in use because of costs, technical limitations and a lack of maintenance. Updates can cause problems with older applications that depend on a specific PHP version. “There are servers that have not been updated for two, three or even ten years,” says Smaragdakis. Organisations running unsupported versions may first need to upgrade to a newer version before they can install the security patch.

PHP developers released updates for supported versions yesterday afternoon. Organisations running older versions should check with their providers to see whether additional security updates are available. Even when a patch is ready, it can take weeks for organisations to update their systems, according to Smaragdakis. Smaller companies in particular may lack the staff or resources to do so quickly.

Previous vulnerabilities, such as Heartbleed in OpenSSL in 2014 and vulnerabilities in the Next.js web framework, show how difficult it can be to roll out security updates quickly. According to Smaragdakis, discovering a vulnerability is only the first step; installing the patch takes time, too. For organisations that cannot update their systems immediately, he recommends temporarily restricting public access to applications or taking them offline.

Greater technological diversity and better security

Greater technological diversity could prevent a vulnerability in one system from having immediate consequences for a large part of the internet, Smaragdakis says. Companies should also build security into software development from the outset, rather than focusing primarily on delivering new applications quickly. “Security is more important than developing new software. We need to build software that is secure,” Smaragdakis emphasises.

However, security is not just about software development. Organisations also need to understand which technologies and suppliers they depend on. “A large part of our digital infrastructure runs on components maintained by small teams that organisations rarely think about. You cannot eliminate these dependencies, but you can understand them,” says Jordens. “PHP is in the news today, but next time it will be something else. Organisations that know what their systems are built on will simply be better prepared.”