A security problem in PHP, one of the most widely used programming languages for building websites, has triggered an urgent response from businesses and government agencies around the world. Some websites have been taken offline while their operators install security fixes, as researchers warn that hackers are already trying to exploit the flaws.
The incident raises an important question about internet security, how can a problem in a single programming language put so many websites at risk? Here are five things to know about the PHP security crisis.1.
What is PHP?When someone opens a website, several things happen behind the scenes before the page appears on their screen. PHP is one of the programming languages that helps websites carry out these tasks, including processing requests and working with databases.First released more than 30 years ago, PHP remains a key part of the technology used to run websites.
WordPress, a popular platform for publishing online content, depends on it. Drupal, which is also used to build websites, runs on PHP as well.The scale of its use makes this incident particularly serious.
It is being estimated that PHP is used by around 70 percent of websites. This includes sites operated by businesses and public institutions, meaning a flaw in the language can create problems across very different types of online services.
2. What is wrong with it?The problem lies in how PHP handles computer memory and errors.
These functions are involved in the ordinary operation of websites, making the vulnerabilities particularly concerning.An attacker could send a specially crafted request to exploit the weaknesses and interfere with a website's memory. This could open a route to the server's files or database, according to the US National Security Agency.
A server is the computer system that stores a website's data and helps deliver its content to visitors. If an attacker gains access to it, the consequences could extend beyond a website displaying an error.
Depending on the circumstances, the attack could put stored information and the wider system at risk.Cybersecurity company Hadrian has called the exploitation technique PHP2Shell. Security researchers have warned that the flaws are already being targeted, making the issue an immediate concern rather than a risk that websites need to prepare for at some point in the future.3.
The problem extends far beyond individual websitesPHP's popularity is also what makes the vulnerabilities difficult to contain. A weakness in software used by a handful of websites would have a limited reach.
A weakness in a language used across a large part of the internet creates a much bigger challenge.The PHP Foundation, which looks after the language, has explained that the affected components are deeply connected to its operation. Changing them without affecting existing websites, performance or extensions developed by other programmers is not straightforward.Website operators therefore need to identify whether their systems use affected versions and apply the relevant fixes.
The challenge is particularly significant for large organisations that run multiple websites or services and may not have a complete picture of every system using PHP.4. AI helped uncover the flaws, but it can also help hackersThe discovery shows how artificial intelligence is changing software security.
AI models can examine large amounts of code and help identify weaknesses that might escape conventional checks or take researchers considerable time to find.The PHP Foundation said it had used an advanced AI model from Anthropic to examine PHP's code. The language was also submitted to OpenAI's Patch the Planet programme, where the vulnerabilities were identified around the same time as by independent researcher Ryan A in mid-August.The flaws were due to be disclosed publicly on October 22, allowing organisations time to prepare updates.
However, the PHP Foundation moved the announcement forward after information about the vulnerabilities began appearing on online forums and social media.There are also signs that attackers may have obtained information early. Amazon Threat Intelligence reported an attempted exploitation four days before the public disclosure.
It also found proof-of-concept exploits before the scheduled announcement. The available information does not establish exactly how the earlier attacker learned about the flaw.AI can help developers secure software faster, but it can also give malicious actors more ways to discover weaknesses.
That creates a race between those trying to protect systems and those attempting to break into them.5. Security patches are available, but the risk depends on how quickly they are installedThe PHP Foundation has released fixes, and some organisations have temporarily shut down their websites to install them.
Several services returned after their systems were updated. However, the release of a fix does not mean every vulnerable website has been secured.
Organisations must locate all their PHP installations, check which ones need updates and make sure the patches are applied. Taking an affected service offline may be necessary if it cannot be secured immediately.Experts have warned that websites still accessible to visitors could remain exposed if their operators have not acted.
Being online is not proof that a website is safe.The incident has also drawn attention to the people responsible for maintaining essential internet software. The PHP Foundation has only 13 full-time and part-time engineers and depends on financial contributions to support its work.- Ends