Government websites in Europe and elsewhere have gone offline after news of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems. Developers of the PHP programming language on Wednesday released urgent new fixes, saying all users were “encouraged to update immediately”. PHP runs on the servers that host websites, building pages behind the scenes before they reach a visitor’s browser.
Most people never see it, but it powers everything from blogs to online shops and government portals. The vulnerabilities, which had been lurking in the software for years, were uncovered with the help of artificial intelligence. Details about them leaked online on Tuesday before fixes were available, forcing PHP to rush them out.
Experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of the updates. Andrew Cullen, a lecturer on AI and cybersecurity at the University of Melbourne, said many devices in the world are connected to one piece of foundational software, which is where the bug was found. The vulnerability allows a hacker to run code on a website, meaning they could change the website or force it to release personal information collected in a database, Cullen told Al Jazeera.
Both flaws stem from how PHP handles fatal errors, such as running out of memory. Because the problem sits in PHP itself, even the simplest website running an affected version can be vulnerable, and attackers could read passwords and other credentials from a server’s memory, the cloud security company Wiz said. Both flaws scored 9.2 out of 10 on the industry’s standard severity scale, placing them in the “critical” category.
The two flaws, nicknamed PHP2Shell, were found independently by two cybersecurity companies using AI. Calif, working with OpenAI, reported the first on August 11. Wiz, which is owned by Google, reported the second on August 24.
The vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to take advantage of, Wiz said in a statement. Calif and Wiz said they had coordinated with each other, the PHP team and OpenAI before making the vulnerabilities public. However, Amazon security chief CJ Moses said his security team detected an attempt to exploit the vulnerabilities on October 17, four days before the public disclosure.
Extract — continue reading at the source.
