Several government agencies, mostly in Europe, went offline for a period of time after critical vulnerabilities were discovered in PHP, a programming language widely used by websites all around the world. The developers of the programming language urgently rolled out new fixes to patch said issues, many of which had been lurking in their software for years, and encouraged users to “update immediately”.
Detecting Threats With AI
The PHP vulnerabilities were discovered by cyber companies Wiz and Calif, who say that it used AI-powered tools from Google and OpenAI to trace them down. The discovery reportedly brought down about 70% of the internet. That’s just a rough estimate, by the way.
Wiz and Calif, along with the PHP Foundation, were part of a program called Patch the Planet, which was started by OpenAI. The program essentially gives access to the latter company’s AI tool to find and fix flaws in web development language.
Almost all of the flaws had reportedly gone undetected for more than a decade. The discovery forced PHP to expedite the rollout of its patch, the announcement of the vulnerabilities, and just how severe they are.
PHP On Every Website
PHP, short for Personal Home Page, is a programming language that was developed back in the early 1990s and is, today, used as the backbone of virtually every website and tool: WordPress, Drupal, Joomla, Magento. These are just some of the sites that run on PHP. If you’re looking for a number, according to Dutch internet intelligence firm Censys, there are about 2.6 million hosts that run on PHP, 1.5 million of which say that the version of it running on their system has no fix.
As a precaution, the agency and operator of Wikipedia took itself offline until the vulnerabilities were addressed and patched. In Japan, Prime Minister Sanae Takaichi posted on X, asking people to check if their websites were running on PHP.
The bigger underlying issue here is just how pervasive PHP is; many companies base their site on the programming language without ever advertising that they do. “The use of PHP is pervasive; it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it,” Cyber-security expert Don Smith, from the Sophos Counter Threat Unit, said to the BBC.
It also isn’t clear which versions of PHP are affected. CERT-EU said it could affect all versions of it dating back to PHP 5 onwards – which launched in 2004.
