A critical flaw in the PHP server language has been discovered and exploited by artificial intelligence (AI) agents for cyber attacks. The speed of these attacks has increased, while traces of breaches are harder to detect, raising alarms among domestic companies regarding their security measures.
On October 25, the threat analysis team Unit 42 from the American cybersecurity firm Palo Alto Networks reported that attackers targeting the PHP vulnerability utilized an 'agentic AI attack platform.' Agentic AI refers to AI that can autonomously set goals and select tools without human intervention.
This AI agent infiltrated government networks in France, Finland, Denmark, and the Netherlands, securing critical information within just two hours. The rapid pace of the attack leaves little time for human response once it begins. The cases confirmed by Unit 42 demonstrate that AI can operate independently during the attack phase.
There are two main vulnerabilities: one that fails to handle exceptions properly and another that rewrites already freed memory. Both received a maximum risk score of 9.2 on the Common Vulnerability Scoring System (CVSS). Websites running versions prior to the security update, including PHP 8.5.12, are all potential targets.
Attackers can execute malicious code remotely without user interaction under specific conditions. This flaw was first identified by the American security firm Calif using OpenAI's AI model 'GPT-5.6 Sol' on August 1, and was reported to PHP developers on August 11. Wiz also independently reported the two vulnerabilities on August 24.
The vulnerabilities remained undisclosed for over two months before being made public with a security update on October 21. According to Wiz, about 70% of websites worldwide use PHP, including widely used platforms like WordPress and Gnuboard.
The extensive impact is due to the flaw being in the PHP engine itself, rather than a specific site configuration issue. This makes it difficult to confirm whether a breach has occurred. The flaw exists at a level below web applications, meaning that standard application logs may not capture traces of the attack.
Cybersecurity firm SGA Solutions highlighted key indicators to check in their 'PHP2Shell Emergency Security Advisory and Response Guide,' including unusually long or corrupted PHP session cookies (PHPSESSID), recurring HTTP 500 errors, and frequent restarts of PHP worker processes handling requests. Even in the absence of these signs, the possibility of a breach cannot be ruled out, necessitating a thorough analysis of web server and web application firewall (WAF) logs, as well as PHP error logs.
Patching remains a challenge. Security updates have been released for PHP versions 8.2 and above, but companies using versions 8.1 and below, which are no longer officially supported, must apply separate source patches or upgrade to a higher version. The cybersecurity industry advises checking the PHP version of operational websites and servers, applying security patches, and assessing potential breaches.
Professor Yeom Heung-yeol from Soonchunhyang University’s Department of Information Security stated, 'This vulnerability was discovered using AI by security researchers, demonstrating that the era of AI identifying security vulnerabilities has become a reality.' He urged both public institutions and private companies to promptly check their systems and websites for this vulnerability.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.