The language that is considered the backbone of Internet is now affected by what experts describe as one of the most notable vulnerabilities of recent times.
PHP is a language scripting of very widespread general use, oriented towards web development and which, therefore, is the engine of the vast majority of websites around the world. When the organization responsible for the language and the FBI’s cyber division alerted on Wednesday of the existence of significant vulnerabilities in the languagegovernment agencies, businesses, and other organizations were thrown into uproar.
The episode also highlights how artificial intelligence is changing the game when it comes to web security.
Below we explain what to take into account when discovering vulnerabilities and their consequences.
The vulnerabilities
The official PHP website and other organizations and agencies on Wednesday published security advisories urging PHP users to fix two critical vulnerabilities or close their websites if they cannot update them immediately.
The PHP Foundation, which works to ensure transparency and accountability around the language, has noted that vulnerabilities could be exploited and allow malicious parties to gain unauthenticated access to websites that use PHP.
This would mean that attackers could control a web server remotely without needing a password, said James Sullivan, director of cybersecurity and technology at the Royal United Services Institute in London. This could allow a hacker to steal data, alter it or use the system as a platform from which to launch other attacks, he added.
The scope is enormous
PHP is the foundation on which approximately 70% of websites around the world operate, so the potential exposure to the vulnerability was enormous.
This language is free and open source, which contributes to its wide diffusion on the Internet. PHP is the basis of the WordPress and Drupal content management systems, which are often used by public administrations for their websites, as well as MediaWiki, the software that powers Wikipedia.
According to security advisories released this week, several websites have been taken offline to prevent them from being exposed while the issue is being resolved. There have been disruptions to some government services and websites, including in the United Kingdom, Finland and Japan.
Some web pages may still not work as multiple patches are available for different types of software and some organizations may still be waiting to receive them. Additionally, they need to be tested to make sure they work properly.
Latent problems
According to the PHP Foundation, these vulnerabilities have been known since at least 2024. A security team developed several proposals for alternative solutions, but all of them had drawbacks and it seemed that there was no practical or concrete way in which attackers could exploit the vulnerabilities, so progress on the correction stalled, according to the foundation.
The group took responsibility for not having found a solution sooner, stating: “We are not going to pretend otherwise: the delay was due to a structural failure, caused by both the security team’s decision-making process and its lack of resources.”
Some experts claim that the discovery of the vulnerability could have occurred even before 2024.
The game of cat and mouse
Artificial intelligence agents helped discover the vulnerabilities. In a blog post, OpenAI stated that it had led a coalition of researchers, security vendors and other entities to address PHP vulnerabilities over the past two months. Researchers at Wiz, a cloud security platform, also said they had independently used artificial intelligence to identify the vulnerabilities.
The accessibility of artificial intelligence (AI) means that many organizations, both large and small, now have more advanced methods to proactively and reactively respond to security threats. But it also means that criminals have more advanced methods to exploit digital weaknesses, and on a large scale.
James Sullivan, of the Royal United Services Institute in London, said this back-and-forth may be worrying, but he is focusing on the positive side.