PHP security flaw: why governments rushed to patch, and what Pakistani site owners should do

“PHP security vulnerabilities” has been trending in Pakistan, and for good reason. Two serious flaws in PHP, the programming language that runs a huge share of the world’s websites, were made public on October 21, and governments from South Korea to Europe are scrambling.

What is PHP, in simple words?

PHP is the code on a website’s server that handles things like logins, contact forms and online orders. According to W3Techs figures cited by Korea JoongAng Daily, about 70% of websites whose programming language can be identified use PHP. WordPress, which runs about 40% of all websites, is built on it.

That means many Pakistani business sites, online shops, school and university portals, news sites and blogs are running PHP.

What is the problem?

The PHP team disclosed two critical flaws, both rated 9.2 out of 10 for severity. One has been nicknamed “PHP2Shell”. In the worst case, an attacker can run their own commands on a server without logging in, and take over a website within seconds.

That could mean defaced websites, stolen customer data or sites knocked offline.

How governments reacted

• South Korea raised its private-sector cyber alert to “caution”, the second of four levels. Security firm AhnLab estimates about 110,000 vulnerable servers there, according to the Kyunghyang Shinmun.
• The US National Security Agency told organisations to patch, or take systems offline if they cannot.
• In Europe, bodies including France’s Interior Ministry and the Dutch cyber security centre temporarily blocked access to some websites.

Found by AI

The flaws sat in PHP’s code for years. According to Korea JoongAng Daily, security firm Calif found them in August during an AI-assisted audit using an OpenAI model, with help from Wiz.

What you should do

If you run a website, or you are a freelancer managing client sites:

1. Check your PHP version. Your hosting panel (cPanel, Plesk or similar) usually shows it.
2. Update now. PHP 8.1 and older no longer get official security updates. Korea JoongAng Daily says users need PHP 8.3 or later to get the new patches. Censys found about 73% of PHP servers worldwide still run 8.1 or older.
3. Ask your host. Many Pakistani sites sit on shared hosting. Ask your provider whether they have applied the emergency patch.
4. Check for signs of a break-in if your server was exposed before you patched: unknown admin users, new files or strange redirects.
5. A web firewall helps, but is only a stopgap. It cannot fully block these attacks.

If you are an ordinary user, there is nothing to install. Just be careful on websites that look defaced or ask for details they normally don’t.