A critical flaw affecting 70% of all websites has the cybersecurity world panicked
Millions of websites and online tools have relied on the PHP language for decades – but newly disclosed bugs could let hackers easily take them over.
A recently discovered vulnerability in the widely-used programming language PHP is causing widespread alarm in the cybersecurity community. PHP, often referred to as "the backbone of the web," powers over 70% of all websites. When left unaddressed, the flaw could enable hackers to easily gain control over and compromise numerous websites and the data stored on their servers.
In response to the threat, various European governments and operators such as the Port of Rotterdam have taken websites offline, while organizations like the Australian Signals Directorate, America's Cyber Defense Agency, and similar bodies from the United Kingdom, Europe, and Japan have urged web developers to apply urgent updates to their core systems. Some experts even suggest considering temporary website shutdowns until safety can be guaranteed.
PHP, a free, open-source programming language since 1997, is responsible for managing user inputs and processing information on the server side of websites. Its versatility allows websites to perform functions ranging from user authentication and online shopping to data retrieval and powering blog posts and news sites. Most users interact with PHP regularly without even realizing it, as it runs on the server rather than their personal computers.
Cybersecurity researchers from Wiz, a company known for finding vulnerabilities, were among the first to uncover the issue. They used their tools and AI models to search through PHP's extensive codebase, identifying ways to exploit the flaw. The PHP developers, who follow standard cybersecurity practices, kept the issue confidential until a patch was ready.
However, a user on Hacker News inadvertently leaked information about the security flaws before the patches were released. PHP's developers then publicly confirmed the issue and released emergency patches ahead of schedule.
The implementation of the patches is complex because PHP is underpinned by thousands of third-party plugins, frameworks, and managed hosting services. Ensuring every layer of the supply chain integrates and deploys the fix is crucial for website security. However, much of the internet is built on foundational technologies developed and maintained by hobbyist developers, often with limited corporate funding.
Many of these tools were created decades ago and were never designed to handle the vast scale of today's web infrastructure.
This ongoing issue highlights the need for businesses and governments to prioritize funding and maintain open-source foundational tools, recognizing their critical role in digital infrastructure security. Until this shift occurs, vulnerabilities like this will continue to pose significant risks.
Written by urgent.news from The Conversation AU's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
