Websites around the world have been shut down as a precaution after AI was used to discover a vulnerability in PHP, commonly used across the internet.
The National Cyber Security Centre is warning NZ organisations to check their sites and update as soon as possible.
The SMC asked experts to comment.
Dr Vimal Kumar, Senior Lecturer, Department of Computer Science, University of Waikato, comments:
“PHP is the underlying technology over which many other systems that people are more familiar with such as, WordPress, Joomla, Drupal, etc. are built. These are then further used by many consumers to power their web applications. Any vulnerability that affects PHP, therefore affects, these other systems and eventually affects web application built upon them. There are some estimates that these vulnerabilities affect 70% of all websites.
“The two vulnerabilities that have been discovered are quite serious in nature and potentially allow an attacker to take control of the system. The good news is that the bug fixes are out, so the best advice would be to patch your systems as quickly as possible and take your website down if you can until that happens.”
Conflict of interest statement: “I have an interest in the cybersecurity startup Capture the bug.”
Dr Shawn Rasheed, Senior research software engineer, Victoria University of Wellington, comments:
“When you visit a website, your web browser retrieves content such as text, images, audio and video. Some content is fixed, but some is generated when you request for it. For example, product listings from a database or personalised information displayed after you log in. PHP is one of the technologies that web servers use to generate this content. It can also powers services used by mobile apps.
“Two critical security flaws in PHP, collectively named “PHP2Shell”, could allow attackers to take control of affected servers without logging in. Attackers could then steal or alter sensitive information, disrupt services and potentially use the compromised server to reach other systems in the organisation. The problems are in the PHP software, but websites and apps that depend on affected servers can suffer the consequences.
“PHP is used by about 70% of websites, so the potential impact is substantial. However, using PHP does not by itself mean that a service has been compromised. The risk to users depends on whether the service is vulnerable and whether attackers have successfully exploited it.
“Both vulnerabilities are rated critical, with a severity score of 9.2 out of 10. New Zealand’s National Cyber Security Centre (NCSC) is aware of active exploitation of the flaws.
“Affected organisations should apply the security updates immediately and check for evidence of unauthorised access. Where immediate updating is not possible, the NCSC recommends considering temporarily disabling public access to affected services. Applying a fix does not undo damage or remove access an attacker may have already established.
“Small businesses and anyone who owns a website should contact their hosting provider or website administrator to confirm whether their services are affected and whether the necessary updates have been applied. Ordinary users should follow any specific instructions issued by affected services.”
Conflict of interest statement: No statement recieved.
Professor Dave Parry, School of IT, Murdoch University, comments:
“This is a big deal! PHP was one of the first server-side web languages. It’s ‘open source’ which means it’s free to use, works with many other tools and developed and improved by the community. This makes it attractive and it’s very widely used in huge numbers of government and commercial websites.
“Governments and schools/universities in particular often preferred it because it’s not dependent on one supplier and easy to use. One of the things it does is allow webpages to ‘talk’ to databases on servers, which is vital for things like shopping, filling in online forms etc. It’s also the basis for a lot of website builder applications like WordPress.
“The vulnerability appears to have been discovered by AI – this is one of the first announcements of its type.
“We have no idea of whether it has been exploited, which could be worrying. A major attack against PHP websites could steal/affect a lot of vital data, so this needs patching – but of course you need to know you are using it. Just as if there was a safety recall on a particular type of brick or fastening, a lot of building owners are potentially affected, but finding out if you are depends on good records and sharing information. the response from government reflects this.
“I think there will need to be a lot of auditing and record keeping going forward and I think there will need to be an updating of policies about this in companies, government and schools etc.”
Conflict of interest statement: “No COI.”
Dr Farkhondeh Hassandoust, Senior Lecturer, Information Systems, University of Auckland Business School, comments:
“A website going offline does not necessarily mean it has been hacked. In some cases, temporarily shutting down a service is a sensible precaution while security teams apply the required fixes.
“For New Zealand organisations running PHP-based websites or applications, including those built on platforms such as WordPress, Drupal and Joomla, the immediate priority is to check which versions of PHP they use and apply the latest security updates. This includes systems hosted or managed by external providers. Public-facing services, particularly those handling sensitive information, should be prioritised.
“There is also a broader concern about AI. The same tools that help security researchers discover hidden flaws can also help attackers exploit them. This means organisations may have less time to respond before a vulnerability becomes a serious threat.
“The key lesson is that cybersecurity is not simply about having the right technology. It also requires clear accountability, effective risk management, and the ability to make timely decisions under pressure.”
Conflict of interest statement: “No conflict of interest.”