PHP Warning Highlights Battle Between AI Speed, Cyber Hygiene

An Oct. 21 alert about a pair of web server vulnerabilities collectively known as php2shell has emphasized the increasing speed with which artificial intelligence can find susceptible weaknesses and how fast enterprises can address them.

The Cybersecurity and Infrastructure Security Agency (CISA) urgently warned Wednesday that organizations immediately update their hypertext preprocessor (php) code on internet-facing systems to protect against php2shell vulnerabilities.

Those vulnerabilities could allow intruders the ability to execute remote code into affected servers without logging in and steal or alter data through a server programming language reportedly running on 70% of the world’s websites.

“While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched,” the alert said.

CISA and other international entities directed organizations to immediately patch or take their PHP-based systems offline so they could be updated. That led to reports of some government services being taken down in countries including the United Kingdom, Japan, Finland and others.

Currently, no federal government websites reported experiencing outages as a result of php2shell, but David Williams, founder and CEO of UK-based Fior Group, an autonomous security company, said just because a site is operational doesn’t necessarily mean it’s secure.

“PHP2Shell is particularly dangerous because it can allow an unauthenticated attacker to execute code on vulnerable servers. That creates the possibility of an attacker moving from a compromised public-facing website into more sensitive government systems,” Williams told GovCIO Media & Research.

A CISA spokesperson said Friday that the agency didn’t have additional information beyond the Oct. 21 alert.

AI Speed Versus Patching

The urgency of mitigating php2shell has put a spotlight on AI’s role in discovering, potentially exploiting or protecting against these vulnerabilities, largely because of the speed with which the technology operates.

Security researchers at companies Wiz and Calif used Google Gemini and OpenAI models to discover the php2shell vulnerabilities, which they described as having “been present for decades” through multiple versions of php.

That has led researchers to find existing vulnerabilities more quickly, but it has also removed the resource constraints that would have prevented attackers from finding them. As a result, cybersecurity officials will still have to patch while monitoring for potential exploits, but now much faster.

“The immediate priority is patching, investigating potential compromise and replacing exposed credentials. But the strategic lesson is equally important: governments must design security on the assumption that some vulnerabilities will be exploited before they can be patched,” Williams said. “The critical question is not simply whether an attacker gets in, but what they can do once inside.”

Real-Time Monitoring and Faster Patching

CISA has already been working on ways to provide federal civilian agencies with tools to monitor their network activity and are greatly shortening the time organizations have to patch.

Through its Continuous Diagnostics and Mitigation (CDM) program, CISA has rolled out its cloud-based Security Information and Event Management-as-a-service (SIEMaaS) platform as a way to provide civilian agencies with continuous event monitoring and a logging infrastructure.

Meanwhile, the agency is shifting to its risk-based approach for security patching, providing agencies no more than three days to deploy patches for serious mitigations, necessitating the need for AI tools to monitor continuously and develop mitigations more quickly.

“Three days is not a target to survive; it’s a new baseline for everyone, not just by federal agencies. The organizations that get there won’t be the ones that patch the fastest. They’ll be the ones who patch fast and also trust the underlying data,” said Katie Chrisman, federal solutions engineering team lead at NinjaOne at GovCIO Media & Research’s Federal Cloud & Data Forum on Oct. 8.