PHP: It’s a term that, until last week, many people had never heard of.

That may be surprising, considering the programming language was created all the way back in 1995 and is used to power or partially power roughly 70% of sites and applications.

And yet, PHP only received mainstream attention after a recent vulnerability known as PHP2SHELL was discovered within the system, opening up the potential for cybercriminals to execute malicious code on vulnerable web servers without needing a username, password or any other form of authentication.

The vulnerability would allow an attacker to potentially take control of the server, steal sensitive information, compromise payment data, disrupt websites or use the server to attack other systems, explained Seth Kusiak, chief information security officer and vice president of infrastructure at ASI.

70%
The percentage of sites and applications globally powered or partially powered by PHP (W3Techs)

“Given how widely PHP is used, these vulnerabilities create a significant opportunity for cybercriminals,” Kusiak said.

One of the reasons the vulnerabilities received so much attention so quickly was the role AI played in how they were discovered.

“Security researchers used AI to help identify and demonstrate how the vulnerabilities could be exploited,” Kusiak explained. “This highlights how AI is changing cybersecurity, helping researchers identify security weaknesses that might otherwise take significantly longer to discover.”

While security researchers have observed attempts to exploit these vulnerabilities, there haven’t been any confirmed reports of widespread successful compromises. That’s encouraging, said Kusiak, but it doesn’t make the threat any less serious.

“Organizations running affected versions of PHP should apply the available security updates immediately rather than waiting for evidence of attacks,” he said.

The U.S. Cybersecurity and Infrastructure Security Agency, the federal governmental body responsible for responding to widespread cyber incidents and threats, also released a statement alerting organizations to immediately patch the critical vulnerabilities.

Print and promo companies that operate merch stores for clients could potentially be impacted if their websites or e-commerce platforms use a vulnerable version of PHP.

Customers using ASI’s websites and stores platform, however, aren’t impacted by this vulnerability, as PHP is not part of its technology stack, Kusiak said.

Businesses using other platforms should check with their technology provider to determine whether they’re affected and what actions, if any, are required.

“I’d recommend checking the vendor’s support website, security advisories or email notifications before contacting support directly,” Kusiak said. “Many vendors proactively communicate about major vulnerabilities, and reviewing those updates first can help avoid overwhelming their support teams with duplicate inquiries.”

Additionally, suppliers and distributors should focus on maintaining an accurate inventory of their systems and the technologies they use, both to address the PHP vulnerability and any future threats. “You can’t protect or patch systems if you don’t know what you have,” Kusiak said. According to CISA, PHP is often a component of other software, so it may be overlooked.

Kusiak added that organizations should develop a vulnerability management plan that defines how security vulnerabilities are identified, evaluated and addressed. That also means understanding and communicating responsibilities when it comes to tasks like applying updates and addressing vulnerabilities.

“Depending on the organization, that responsibility may fall on internal IT staff, an outside IT services company, a managed service provider, a software vendor or a combination,” Kusiak added.

As the PHP situation unfolds, companies should monitor security advisories, prioritize vulnerabilities based on their potential impact to their environment and ensure critical security updates are applied promptly.

“Even smaller businesses that outsource most of their IT should regularly check with their providers to make sure these activities are being performed,” Kusiak said.

The full guidance from CISA can be found on its website.