Global Cyber Alert: Critical Flaw in PHP Affects 70% of Websites
Translated & summarized from Globes by baba
A critical security flaw affecting 70% of global websites has been discovered in the PHP programming language, enabling AI-powered attacks. The NSA issued an urgent warning advising websites to go offline if they cannot be patched. The vulnerability, exacerbated by AI, was identified by researchers including those from Israel's Wiz. Organizations are urged to apply software updates immediately to mitigate risks.
The story in 5 lines · by baba
- A critical security flaw in PHP affects 70% of global websites and online services.
- The U.S. NSA warned organizations to take websites offline if they cannot be patched.
- Advancements in AI have made the long-standing vulnerability exploitable.
- Israeli cybersecurity firm Wiz was involved in identifying and patching the flaw.
- Organizations are urged to apply software updates immediately to secure their systems.
A severe security vulnerability discovered in the PHP programming language, which underpins approximately 70% of global websites and online services, has triggered widespread concern. The flaw, reportedly present for years but only recently exploitable due to advancements in artificial intelligence, allows sophisticated attackers to gain direct access to a server's file system or databases. The U.S. National Security Agency (NSA) issued an urgent warning, advising organizations to take their websites offline until the vulnerability can be patched, especially if they cannot immediately install software updates.
The vulnerability lies within the PHP code itself, a widely used, free scripting language that powers the backend of most websites, enabling functions like database interaction and online transactions. This issue affects numerous platforms built on PHP, including WordPress, Joomla, Drupal, and Wikipedia's MediaWiki. Israeli cybersecurity firm Wiz, alongside other companies like Calif and OpenAI, played a role in identifying and developing patches for the flaw, a process that involved complex code adjustments across hundreds of files.
While the vulnerability was known to the PHP development team for two years, its potential for exploitation was significantly amplified by recent AI models. The planned public disclosure of the fix was preempted by an unauthorized leak, causing global confusion and prompting the NSA's advisory. Although no damage has been reported yet, the early leak has created a race between malicious actors seeking to exploit the vulnerability and organizations trying to secure their systems.
Cybersecurity experts and PHP developers are urging users to apply the latest software patches immediately. However, websites running older versions of PHP may not be compatible with the new updates, necessitating alternative security measures or reliance on local cybersecurity services. While major platforms are expected to update quickly, smaller and medium-sized businesses using outdated PHP versions are considered more vulnerable.
Mentioned
