On Thursday, many websites remained offline as a precaution. In the United Kingdom, a technology minister stated that 32 government services were down, largely due to “precautionary measures,” while some sites that had been offline the day before appeared to be back online.
What is PHP and how is it used?
Created in the early 1990s, PHP is a programming language that powers around 70% of the world’s websites.
Unlike a static site, which always sends the same page to every visitor, a PHP-based site is described as “dynamic”: it generates content on demand by querying a database, checking whether the user is logged in, displaying personalized information, or updating content in real time.
It is “the backbone of the web,” described by Wiz Research, a cybersecurity company that has used AI to uncover hidden vulnerabilities in PHP for more than a decade.
PHP, originally short for “Personal Home Page” and later “PHP Hypertext Preprocessor,” is used at the heart of popular website-building platforms such as WordPress, Drupal, or PrestaShop.
The discovered vulnerabilities could allow hackers to breach a wide range of these sites, from online shops to public services, several of which had been taken offline as a precaution.
How did AI find the flaws?
State-of-the-art AI models, including those from American giants OpenAI and Google, were used by Wiz and other groups to uncover PHP’s weaknesses in August. The discovery was kept secret while a fix was developed.
OpenAI described these flaws as “one of the most notable vulnerabilities in recent years,” adding that they “mark a new phase, where AI can discover security bugs with internet-scale impact.”
Independent of Wiz, the Calif cybersecurity company uncovered these flaws as part of a PHP code audit funded by OpenAI.
“The problem with tools like AI is that once all information is made public, people can turn it into a weapon extremely quickly,” OpenAI told AFP.
“The problem with tools like AI is that once all information is made public, people can turn it into a weapon extremely quickly,” declares Steve Kerrison, a cybersecurity lecturer at James Cook University’s Singapore campus, to AFP.
Have any sites already been hacked?
According to the US National Security Agency, the discovered flaws “often provide direct access to the server’s file system or database,” potentially allowing an attacker to take control of these servers without needing a password.
Asked on Thursday by the BBC, Ryan Austin, a researcher who worked on the PHP case for the Calif cybersecurity company, said that “for now, exploitation did not seem to have really taken off or become widespread.”
Amazon Threat Intelligence, dedicated to online threats, nevertheless noted the day before that it had spotted an attempt to exploit the vulnerabilities even before the official disclosure date.
“It remains uncertain how this actor obtained the information related to these flaws,” the company added.
As for the sites that were taken offline, it was primarily a precautionary measure.
“Taking websites offline does not necessarily mean they were hacked. It can be a responsible step to protect systems while applying security updates,” explains Dimitrios Salampasis of Swinburne University of Technology in Australia.
Are there other possible consequences?
Major institutions, from government agencies to media outlets, should be able to secure their websites fairly quickly, but other sites could remain vulnerable.
“Some sites, systems, and people will have absolutely no idea what is happening and will remain in the dark for days, weeks, or even months,” warns Mr. Kerrison.
This could include blogs or other sites run by individuals that could be used to propagate viruses, spam, or malicious content.
The online ecosystem’s complex and interconnected nature, which often relies on third-party interfaces, means that some vulnerabilities may persist even after the initial issue has been resolved.
If third-party interfaces use PHP, “even if you have patched you remain vulnerable,” notes Rahat Masood, a cybersecurity lecturer at the University of New South Wales in Sydney.
