What's happening? Researchers discovered, with the help of artificial intelligence (AI), two critical vulnerabilities in PHP, one of the programming languages used by roughly 70% of websites worldwide. These flaws could allow hackers to modify vulnerable pages, execute malicious code and steal data.
The alert is global. Governments and website administrators have taken steps to prevent attacks. Fixes are already available, but it is not known how many sites have installed them.
Why does it matter? These vulnerabilities could put personal information at risk, including passwords, email addresses and credit card data, if administrators of affected sites do not install the security updates.
In Puerto Rico, PHP is used in only two of the more than 120 government portals, according to Poincaré Díaz, executive director of the Puerto Rico Innovation and Technology Service (PRITS), who described the situation as "concerning" but pointed out that the risk to the government could be minimal.
We explain what PHP is, how it works, how the flaw was detected, what data is exposed and what website administrators and users can do.
What is PHP and how does it work?
"PHP (Hypertext Preprocessor) was a very well-known, very popular programming language in the late 1990s and early 2000s. And many websites, roughly 70% worldwide, use some form of PHP," Rigo Miranda, Principal Software Engineer at Red Ventures, told Platea.
About 55 million websites use PHP, according to Censys, a company that specializes in scanning internet infrastructure.
You may not notice it, but PHP does a kind of silent work to make sure websites interact the way they should on the platforms we use. As sites are updated and gain new features, PHP needs to be updated as well.
How was the PHP flaw detected?
For years, many of these flaws went unnoticed. "Even though rigorous review processes exist, we sometimes miss certain details as humans. Some things were not checked, or a change made in a later version affected earlier ones," the software engineer explained. If updates are not installed, errors from older versions are never fixed.
Now, with artificial intelligence (AI), you can read thousands of lines of code much faster. This allows programmers to run AI-powered simulations to detect flaws in the code. "That way, they keep finding combinations until they find the vulnerability," Miranda explained.
That is how researchers at two cybersecurity companies, Calif and Wiz, both based in the United States, found the two PHP vulnerabilities using an OpenAI program. It took them about two months.
On Oct. 21 they published a paper laying out the flaws, some of which may have existed for more than a decade, and suggested a global response to fix them, primarily through the Patch de Planet website, which aims to improve cybersecurity using AI.
What could be exposed by these vulnerabilities?
These are flaws inherent in the PHP language that affect versions released over decades and could allow hackers to take control of servers and access sensitive information.
"Hackers, or anyone with the right knowledge, can inject code into these servers or websites to do malicious things, such as stealing information or monitoring what the site is doing," Miranda said.
That means they could access passwords, credit card information and other data that users enter on the hacked site.
What did websites do globally?
After the alert, many platforms temporarily took their websites offline.
Wikimedia, the organization behind the digital encyclopedia Wikipedia, brought down many of its systems as a precaution.
Forums such as 4Chan and Something Awful went offline to wait for a fix.
The governments of the Netherlands, France, Finland and Denmark took down several of their websites to prevent attacks, according to Reuters.
Cybersecurity agencies in Europe and Asia also issued alerts asking that sites potentially at risk be taken offline.
In the United States, the FBI, through its Cyber Division, issued an alert and recommended that organizations and website administrators identify where they use PHP, prioritize exposed servers and install available updates. If they cannot be patched, the FBI recommended taking them temporarily offline until they can be secured.
In Puerto Rico. PRITS ordered scans to identify what could be affected, and at least five instances were detected of systems that needed to be updated.
What was PHP's response?
The PHP Foundation, the organization that supports the development and maintenance of PHP, confirmed that it fixed the two critical vulnerabilities, acknowledged flaws in its security processes and explained how AI helped identify the problems.
Fixes. Versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released. The organization urged users to update PHP immediately, since no alternative measures exist that fully eliminate these vulnerabilities, making the patched versions the only safe solution.
What can developers and website administrators do?
Miranda recommends checking which version of PHP their sites use and installing security updates as soon as possible. If a site is old and not compatible with the new versions, he advises seeking technical assistance to avoid problems with its operation.
As a preventive measure: If they cannot update immediately, he recommends temporarily putting the site in maintenance mode, especially if it handles confidential information.
If you built your site with AI: Request a security-focused audit from a specialist and verify that the technologies used are up to date, since AI does not necessarily prioritize protection against vulnerabilities.
What can users do to protect themselves?
According to Miranda, users have few tools to know whether a website is running a vulnerable version of PHP, so they depend mainly on administrators updating their systems. They can, however, take steps to protect their accounts and personal information.
Use strong passwords. Avoid combinations that are easy to guess, such as birthdays, phone numbers or common passwords.
Use a password manager. These are applications that generate and store random passwords with letters, numbers and special characters. They also let you store your passwords securely.
Watch for possible data breaches. If a company notifies you that your data has been compromised, change the affected passwords.
This content was translated with the assistance of Artificial Intelligence (AI).
