Organizations around the world are racing to fix a serious cybersecurity vulnerability that could affect about 30 million websites and could allow attackers to steal personal data, according to what experts told the BBC.
It is noteworthy that the security vulnerability lies in the “PHP” programming language, which is used to operate many platforms. It collects the information you need and displays it on the web in a way that the user can read it.
Several websites stopped working as a precaution or to patch the PHP vulnerabilities reported on Wednesday, but at this time, we do not know whether any hackers succeeded in exploiting the vulnerabilities that appeared in the widely used programming language.
Experts warn that this could allow attackers to remotely run malware on affected web servers or steal data.
“This is the most dangerous vulnerability I have ever discovered,” says Ryan Austin, a researcher at the cybersecurity company Calif, who helped discover the vulnerability in the PHP programming language.
What is the expected effect?
Most users will notice a glitch when they try to access certain websites, but it should be noted that many of these sites are already back up and running; The Wikipedia site, for example, is currently operating at full capacity after undergoing what was described as “emergency maintenance” on Wednesday.
But the fundamental question is what will happen if some sites fail to address these problems? In this case, the situation becomes a bit ambiguous, as the PHP Foundation describes these vulnerabilities as “extremely dangerous vulnerabilities.”
For his part, Austin explains, “There is no doubt about the seriousness of these vulnerabilities. In theory, a hacker determined to carry out an attack may be able to access data on a website, which may lead to the exposure of customer information and personal data, and then the matter may begin to have a direct and actual impact on individuals if the hackers are able to access their personal data.”
He explained that this vulnerability can be likened to “a grammatical error in the construction of a sentence,” but “instead of the sentence seeming ridiculous, it actually leads to someone being able to break into your home.”
When asked what kind of information hackers might have access to, he said: “They will be able to access your personal data, anything you have stored.”
Some large institutions reported that they had detected a large number of attempts to hack their systems.
Matthew Prince, president of Cloudflare, a company specializing in Internet infrastructure, wrote on the X website earlier that the company had monitored “thousands” of attempts to exploit PHP vulnerabilities across its network during the ten hours that preceded its official announcement.
He says that the number jumped "to tens of thousands within 45 minutes of the announcement, then to hundreds of thousands within two hours, and has now reached millions."
Amazon also reported that it had detected attempts by hackers to exploit the vulnerabilities, but its websites are operating normally so far.
No signs of large-scale breakthroughs
Although the two giant Internet companies (Cloudflare) and (Amazon) reported that there have already been millions of hacking attempts, actually and directly exploiting a vulnerability in the PHP programming language, these numbers may seem alarming, but in the field of cybersecurity, there is a big difference between hacking attempts and actually successful hacks.
It is noteworthy that many of these hacking attempts are nothing but automatic scanning operations, as attackers work with the click of a button to scan the Internet in search of sites that may be vulnerable.
These numbers are also likely to include a fair number of "ethical hackers", who scan websites as part of the ongoing emergency response to this problem.
There are no indications yet that major companies or institutions have been hacked by exploiting PHP vulnerabilities.
Even if a site is compromised using this vulnerability, the process is likely to be “slow and silent,” as attackers plant malware to take control of the site gradually and quietly.
At the present time, there is nothing we can do as users, as the responsibility currently falls on companies and institutions to work to protect themselves and us as users.
How did you discover the vulnerability?
Researchers at cybersecurity companies Calif and Waze discovered these vulnerabilities.
Researchers have used advanced artificial intelligence tools capable of analyzing software codes and discovering vulnerabilities at a speed far beyond what humans or ancient systems can achieve.
“Modern software is very complex, and some vulnerabilities may remain undetected for years,” says Salil Kanheri, a cybersecurity researcher at the University of New South Wales in Sydney.
He adds, "The basic software errors were not new, but what has changed is our ability to detect them."
Details of this discovery leaked to the Internet this week, forcing the developers of the PHP platform to quickly announce the security vulnerability and its large size.
OpenAI, the developer of GBT Chat, says in a blog post that this incident “highlights the ability of artificial intelligence to discover security vulnerabilities,” but it also shows how it can “help attackers quickly develop offensive tools and methods to exploit vulnerabilities.”
What is PHP language?
PHP is used to power a huge number of platforms, including online stores, Wikipedia, and WordPress, which is a content management system used by many websites, such as blogs. It stands for "PHP: Hypertext Preprocessor".
Paul Spain, CEO of cybersecurity firm Gorilla, told the BBC: PHP is the code that collects the information you need when you visit a site like Wikipedia, and then displays it in a way you can read it online.
The security warning caused the disruption of services around the world, from gaming platforms to government portals and electronic forums. This includes the Wikimedia Foundation, which is behind the online encyclopedia Wikipedia, as it shut down a number of its systems as a precaution.
