Critical PHP vulnerabilities, suspected data leaks and AI security risks have raised fresh concerns across the technology industry.
What Makes the PHP Vulnerabilities Dangerous?
Two critical vulnerabilities in PHP, collectively known as php2shell, have raised concerns about the security of websites and applications using the programming language. The flaws, publicly disclosed on October 21, affect PHP versions dating back to 5.4 and could allow attackers to execute malicious code remotely and access sensitive information.
Researchers associated with Calif.io, Wiz, OpenAI and Quarkslab disclosed the vulnerabilities. Their significance extends to widely used content management and e-commerce platforms, including WordPress and Magento.
Cloudflare reported observing exploitation attempts before the public disclosure. According to CEO Matthew Prince, attempts increased from thousands to tens of thousands within 45 minutes of the announcement, reaching hundreds of thousands within two hours.
These figures represent attempted exploitation across Cloudflare’s network, not confirmed successful breaches. Emergency updates have been released for affected PHP versions, although organisations using unsupported legacy versions face additional difficulties securing their systems.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
How Is Artificial Intelligence Changing Cybersecurity Risks?
The discovery has renewed concerns about the growing ability of artificial intelligence to identify software vulnerabilities. Researchers used AI-assisted techniques in work associated with the PHP flaws, highlighting how such tools can accelerate security research.
However, the same capabilities could potentially be exploited by attackers. Cybersecurity specialists have warned that traditional application-level protections may not adequately address vulnerabilities originating within the PHP engine itself.
Razorpay co-founder and CEO Harshil Mathur expressed concern about the recent developments, while cybersecurity expert Dinesh O Bareja said Indian enterprises still face significant challenges in identifying and responding to AI-powered attacks. Bareja also noted that the use of such capabilities by organised cybercrime groups and advanced persistent threat actors had not yet become mainstream.
What Security Incidents Have Affected Indian Companies?
State Bank of India reported a suspected customer data leak after receiving alerts on October 16 from its threat intelligence provider, the Defence Cyber Agency and CERT-In.
A preliminary investigation identified more than 375,000 potentially exposed records, including 3,897 containing personally identifiable information. The reported data included customer contact details, identifiers and information associated with loan records. SBI stated that the incident had no material impact on its core operations, financial performance or business continuity.
Separately, Bengaluru-based digital certificate provider eMudhra reported a key-generation weakness affecting eight intermediate certificates. The company said it was replacing affected certificates and expected the process to take several days.
eMudhra maintained that no website certificates had been issued using the weak keys and that its Indian digital signature and eSign services remained unaffected.
What Measures Are Authorities and Companies Taking?
CERT-In issued a critical-severity warning on October 21 concerning the PHP vulnerabilities, cautioning that attackers could exploit them remotely to execute code and potentially control affected servers.
The US National Security Agency’s Cybersecurity Collaboration Center advised organisations unable to address the vulnerabilities immediately to consider taking affected websites offline.
The PHP Foundation was notified of the vulnerabilities on October 20, although researchers at Calif had initially identified them in July. OpenAI, Google and Calif worked on fixes in early October.
Cisco also began examining its products for possible exposure and stated that no affected products had been identified at the time of its announcement.
The420 Insight: The developments underline the importance of timely security updates, effective vulnerability management and stronger oversight of sensitive data. Organisations operating outdated software face particular challenges as AI-assisted vulnerability discovery increases the pressure on existing cybersecurity defences.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
