Serious security flaws have been found in PHP, the programming language that underpins a large part of the internet. The flaws, identified using artificial intelligence (AI), had gone unnoticed for more than a decade. By exploiting them, attackers can take control of affected web servers without any authorisation and steal sensitive data. Cyber security alerts were issued around the world on Wednesday. Governments and cyber security agencies in several countries told website operators to install security updates quickly and advised them to take their websites offline temporarily if that was not possible.
Researchers at the cyber security firm Wiz identified the flaws. The company described them as the most serious security flaws found by AI so far. OpenAI, the maker of the technology used to find them, called it one of the most consequential security problems of recent times.
What PHP is, and why the risk is so great
PHP is a programming language; the name stands for PHP: Hypertext Preprocessor. Though the name is unfamiliar to many, countless people use websites that depend on it every day. The language has been widely used to build websites around the world since the 2000s.
Many websites depend on PHP, including online shopping platforms, Wikipedia and WordPress. WordPress is a content management system used to build and run blogs and many other kinds of websites.
Paul Spain, chief executive of the cyber security firm Gorilla Cyber Security, said that when someone visits a website such as Wikipedia, PHP code gathers the information needed and presents it on the web page in readable form.
But the security flaws in the technology have put many websites that depend on it at risk. By exploiting them, attackers can take control of affected web servers and steal sensitive data without any identity check or authorisation.
According to Spain, the use of AI could make such attacks easier and faster. He believes millions of websites could be put at risk by the flaw.
Jill Slay, a cyber security researcher at the University of Adelaide in Australia, said the consequences would be dire if hackers or a country used the flaw as a weapon to steal personal data from websites.
Websites shut around the world
As warnings of the security risk spread, websites and online services in many countries were disrupted. Services of all kinds were affected, from gaming platforms to government websites and online forums.
Wikimedia, which runs the online encyclopaedia Wikipedia, shut down some of its systems as a precaution.
The government of Finland, the City of Edinburgh Council and the BBC also took some of their websites and web pages offline. The Netherlands’ cyber security agency shut down its own website. Various government bodies, local councils and health boards in Scotland also took their websites offline as a precaution.
Experts say websites that are not maintained regularly may be at greater risk. Websites of small organisations, with limited security management and funding, could become easy targets for cyber attacks.
Salil Kanhere, a cyber security researcher at the University of New South Wales (UNSW Sydney) in Australia, said attempts to exploit the flaws could rise in the coming weeks, because their technical details are now becoming public.
Urgent updates to fix the flaws
After the flaws, hidden in the software for years, were found, PHP’s developers released security updates to fix them on Wednesday. PHP strongly urged all users to update their software quickly.
Government authorities and cyber security agencies in many countries gave website operators the same advice.
The US National Security Agency (NSA) told all organisations using PHP to apply the security updates immediately. If they cannot update at once, the agency advised them to shut down their systems.
The NSA said the flaw could open a direct path to attack a system’s database. The risk in US government departments and agencies is so serious that security updates are needed there immediately, it said.
The UK’s National Cyber Security Centre issued a similar warning. It also asked organisations to check whether attackers had left a secret way into any system, a “backdoor”.
The relevant agencies of the European Union, Singapore and Australia issued similar warnings.
Japan’s Prime Minister Sanae Takaichi urged citizens to check whether their own publicly accessible websites run on PHP.
“We urgently ask everyone to take action tonight,” she wrote on the social media platform X on Wednesday.
Takaichi added that if applying the security patch quickly is difficult, steps such as taking a website offline temporarily could be considered to reduce the risk.
Technology companies are also moving quickly to secure their systems. The e-commerce company Amazon said it had been the target of several attempted attacks a few days before the PHP flaws became public. It is not yet known how the would-be attackers learned of the flaw.
How AI found the flaws
Researchers at the cyber security firms Calif and Wiz used advanced AI technology to identify the flaws in PHP. These AI systems analyse software code and can find flaws far faster than humans, and faster than many earlier conventional tools.
Kanhere said modern software is extremely complex, which is why some security flaws can go undetected for years.
“The underlying flaws are not new; what has changed is the ability to find them,” he said.
Information about the discovery leaked online this week. In response, PHP’s developers quickly announced the flaws and set out how widespread the problem is.
OpenAI, the maker of ChatGPT, said in a blog post that the episode showed how AI can find security flaws in software, but that attackers could use the same technology to build offensive tools and attack methods quickly.
OpenAI has also released a programme to check the security of PHP.
Ryan Ko of the cyber research centre at the University of Queensland in Australia said that in the past much software was built with more emphasis on functionality than on security, and that many security flaws stem from structural weaknesses in such software.
How to stay safe
Experts urged website operators to secure their websites by using the latest version of PHP.
According to Spain, applying PHP security patches is a small, routine task for most technology teams, so updates should be possible quickly.
The NSA advised staying on extra alert for the next few weeks and following updated guidance from software suppliers closely.
It said maximum vigilance over the prompt application of security patches to the systems concerned is vital.
The main responsibility for security lies with website operators, but users must also be careful. Kanhere said that if affected services give security instructions such as changing passwords, users should follow them.
Fraudsters could also take advantage of the wide publicity to send phishing messages aimed at getting passwords or personal data from users. He advised caution about clicking unfamiliar links or giving personal information in response to suspicious messages.
বাংলায় মূল প্রতিবেদন পড়ুন · Read the original Bengali report