Serious flaws in a technology that underpins the internet went unnoticed for more than a decade, and artificial intelligence (AI) is reported to have helped bring them to light. The discovery has prompted cyber-security warnings around the world.
The vulnerabilities are in PHP, a programming language that has been used internationally to build websites since the 2000s.
Governments and cyber-security agencies around the world moved to deal with the fallout of Wednesday’s discovery, urging website operators to install a new emergency fix or consider taking their platforms offline.
The vulnerabilities were uncovered by researchers at the cyber-security company Wiz. The flaws have been described as the most serious yet identified by AI.
They were found using OpenAI’s technology. OpenAI called the discovery one of the most significant security problems in recent times.
Most people may never have heard of PHP, but they certainly deal with it every day. Its full name is PHP: Hypertext Preprocessor.
PHP powers countless platforms, including online shops, Wikipedia and WordPress, the content management system behind many websites such as blogs.
Paul Spain, chief executive of Gorilla Cyber Security, told the BBC that when you visit a website such as Wikipedia, PHP is the code that gathers the information you need and presents it in a form you can read on the web.
But a flaw that could have let attackers take control of affected web servers and steal sensitive data without authentication left everything built on PHP exposed.
Spain said AI could make such attacks easier and faster, and estimated that the flaw could affect millions of websites.
Jill Slay, a cyber-security researcher at the University of Adelaide, said it would be dreadful if hackers or a state used the flaw as a weapon to steal personal data from websites.
Which websites were affected
The warnings disrupted services worldwide, from gaming platforms to government portals and online forums. They included Wikimedia, the organisation that runs the online encyclopaedia Wikipedia, which shut down several of its systems as a precaution.
The Finnish government, Edinburgh council and the BBC took their sites and pages offline, and the Netherlands’ cyber-security agency also took down its website. Several public bodies in Scotland, including councils and health boards, also took their websites offline.
Some experts warned that the vulnerability could put poorly maintained websites at greater risk, especially those of small organisations with limited security resources.
Salil Kanhere, a cyber-security researcher at UNSW Sydney, said that as the technical details were now being made public, more attempts to exploit the flaws were likely in the coming weeks.
What happened after the flaws came to light
The developers of the PHP platform on Wednesday published initial guidance on fixing vulnerabilities that had been hidden in their software for years.
They said all PHP users were strongly urged to update immediately. Authorities and security agencies around the world repeated the same warnings to website operators to secure their platforms.
A US national security agency advised all organisations using PHP to take their systems offline if they could not fix them immediately.
The agency also said the flaw could open a ‘direct path’ to hacking a system’s database. ‘These risks are so serious that immediate action is required across US government departments and agencies,’ it said.
Britain’s National Cyber Security Centre gave similar advice and told organisations to check for ‘backdoors installed by attackers’.
Its counterparts in the European Union, Singapore and Australia issued similar warnings. Japanese Prime Minister Sanae Takaichi urged people to check whether their publicly available websites run on PHP.
Technology companies have also been racing to secure their systems. E-commerce giant Amazon said it had come under attack several times in the days before the PHP problem became public. It is not known how the would-be attackers learned of the vulnerability.
How AI is finding weak spots
The vulnerabilities were found by researchers at the security companies Calif and Wiz.
The researchers used advanced AI tools that can analyse code and find flaws much faster than people or older systems.
‘Modern software is extremely complex, and some vulnerabilities can stay hidden for years,’ Kanhere said.
‘The underlying flaws were not new; what changed was our ability to find them,’ he said.
With details of the discovery leaking online this week, the developers of the PHP platform were forced to make a hurried announcement about the security flaws and their extent.
Ryan Ko of the University of Queensland’s cyber research centre said most of the flaws stemmed from past ways of building software, which were designed only for functionality, without security in mind.
What people can do to protect themselves
Website owners are being urged to secure their sites with the latest version of PHP.
Spain said the PHP software patch is a small, simple fix for most technology teams.
The US agency urged extra caution in the coming weeks and close monitoring of updates from software vendors.
Kanhere said the responsibility lies mainly with website operators, but users should also watch for any security advice issued by affected services, such as requests to change passwords.
He also urged people to be wary of any phishing messages that exploit the publicity around the incident.
বাংলায় মূল প্রতিবেদন পড়ুন · Read the original Bengali report