Critical PHP flaw puts retail websites and e-commerce systems on alert

NEW YORK — Retailers are being urged to update their web infrastructure immediately following the disclosure of two critical vulnerabilities affecting PHP, the technology underpinning widely used e-commerce and website platforms, including Magento, WooCommerce and WordPress.

The vulnerabilities, collectively known as PHP2Shell, could allow an unauthenticated attacker to execute code on an affected web server, potentially giving hackers access to websites and sensitive information stored in server memory. The PHP development team rated the vulnerabilities as critical and said updating affected systems is the only safe option.

The threat matters most for retailers because PHP powers a wide range of e-commerce sites and other customer-facing web applications. E-commerce cybersecurity firm Sansec said that Magento, WooCommerce, and Shopware stores are among the potentially affected systems.

Unlike a vulnerability in an e-commerce platform or plug-in, PHP2Shell resides in PHP itself. That means retailers cannot necessarily address the threat by simply updating their storefront software. Businesses that outsource their web infrastructure may instead rely on hosting, cloud, or technology providers to deploy the necessary PHP updates.

Researchers at the cybersecurity company Wiz demonstrated unauthenticated remote code execution against WordPress, Drupal, and Joomla environments. However, because the vulnerabilities are in PHP rather than the applications, exploitation doesn’t require a specific content management system.

Researchers say a successful attack could also expose information stored in PHP process memory, potentially including passwords, authentication tokens, API keys, and certificates.

PHP released patched versions on Wednesday and urged users to update immediately. The organization said all PHP installations serving web requests should be considered at risk and that no complete alternatives exist for updating affected systems.

The disclosure could be especially challenging for companies operating legacy web infrastructure. PHP versions 8.1 and earlier are no longer officially supported, so organizations using older versions may need vendor-provided fixes or upgrades to supported PHP releases.

Cybersecurity authorities are also warning that businesses may have little time to respond. The Dutch National Cyber Security Centre said that public proof-of-concept exploits were already available Wednesday and that large-scale exploitation was likely in the short term.

The incident also highlights an emerging cybersecurity challenge for retailers and other businesses: artificial intelligence is accelerating the race on both sides of the vulnerability spectrum. AI tools helped researchers uncover and exploit flaws buried in PHP’s code for years, according to The Wall Street Journal. Those same capabilities could make it easier for attackers to analyze newly released patches and develop attacks against systems that have not yet been updated.