From BBC News · · 2m
Critical PHP flaw exposes 30 million websites
A severe vulnerability in PHP, the code powering vast swathes of the internet, has forced governments and companies worldwide to rush protective measures before hackers exploit it.
In brief
A severe vulnerability in PHP, the code powering vast swathes of the internet, has forced governments and companies worldwide to rush protective measures before hackers exploit it. Critical flaws in PHP, which powers about thirty million websites, have forced governments and major companies including Amazon to…
Critical flaws found in PHP
The UK government is working to identify exposure in its online services after critical cyber-security flaws were discovered in PHP, the programming language powering a significant number of the world's websites.
Amazon and others rush to patch
Governments and some of the world's biggest companies, including Amazon, are rushing to protect systems that use PHP before hackers can exploit the flaws.
AI discovered the vulnerability
The flaws were first discovered by AI, after which governments urged anyone who uses PHP to address them immediately.
Scale of the problem
PHP powers about thirty million websites, including online shops, Wikipedia and WordPress. The flaw affects a vast number of platforms that underpin how the internet runs.
What attackers can do
An attacker can get their own code onto the webserver and run it to steal data, move deeper into networks, or plant a backdoor for later access. The nature of the flaw is extremely serious.
“They can steal data, they can go to other parts of your network. All sort of things like that - even plant a backdoor to get in later on, so it's pretty serious.”
Researcher calls it most serious
Cyber security researcher Ryan Austin, who discovered the flaw after twenty years researching PHP security, called it the most serious vulnerability he has ever found. He used AI to help identify it.
“the most serious vulnerability I've ever found”
Amazon attacked before patch ready
Amazon identified a PHP two Shell exploitation attempt on seventeen October targeting one of its honeypot systems. Subsequent attacks on twenty-one October, after details leaked on social media, suggested multiple actors were involved.
AI accelerates threat response
The use of AI means more actors can act within hours or even minutes once technical details of a vulnerability are disclosed. What used to take months to expose is now taking days.
Websites going offline worldwide
The Office for Budget Responsibility, Edinburgh and Oxford council websites, the Dutch cybersecurity agency, Finland's government services and Wikipedia have all taken systems offline.
Here's the gist
Critical flaws in PHP, which powers about thirty million websites, have forced governments and major companies including Amazon to urgently patch systems before attackers can exploit them.
