ForumIAS LATEST
- Interview Guidance initiative by ForumIAS – UPSC CSE 2026 Click Here to know more →
- FRC 2027: SFG Residential program | accepting application for Tranche-2 Click Here to know more →
- CSAT Classes for Prelims 2027 by Rishi Bhargav sir starts 16 Nov. at 5 PM Click Here to know more →
News: Several websites worldwide went offline on Wednesday as governments and cybersecurity agencies responded to two critical vulnerabilities in PHP, known as PHP2Shell.
About PHP2Shell
- PHP stands for Hypertext Preprocessor.
- It is an open-source programming language that is free to use.
- Function: PHP works behind the scenes to process information, such as logins, application submissions and online purchases.
- It also helps assemble website elements and display them correctly.
- Importance: About 70% of websites with identifiable server-side languages use PHP, according to Wiz.
- WordPress, which powers over 40% of websites globally, also uses PHP.
- PHP2Shell: PHP2Shell refers to two critical vulnerabilities in PHP that could allow attackers to execute malicious code on affected web servers remotely without logging in.
- Two vulnerabilities:
- Memory problem: When an error interrupts a process, PHP may treat incomplete information as valid, creating a security weakness.
- Leftover information: PHP may use information left from an earlier request while processing a new request, causing incorrect handling.
- Two vulnerabilities:
- Risks: Attackers could install malware, remove website content, access sensitive information, passwords or login credentials, and interfere with server operations.
- Solution: The PHP Foundation released security patches and urged website operators to install them immediately.
- If immediate updates were not possible, cybersecurity agencies advised temporarily taking affected websites offline.
- Challenges: Small website owners using shared hosting, older systems and devices may face difficulties in identifying PHP installations and applying updates.
