For more than a decade, serious flaws in the technology that powers large parts of the Internet went undetected.
To detect these flaws, the help of Artificial Intelligence (AI) was taken and after this an alert was issued across the world regarding cyber security.
According to BBC correspondent Osmond Chia, these flaws are in a programming language called PHP, which has been used to create websites around the world since the 2000s. In India too, a large number of websites and online services depend on this technology, so its impact can reach Indian users and institutions as well.
After these flaws were discovered on Wednesday, governments and cyber security agencies around the world have started trying to stop its impact. They advised website operators to install a new emergency security update or take their platforms offline if necessary.
Cyber security company Viz is among the companies whose researchers discovered these flaws. The company has described these as the "most serious" flaws ever discovered with the help of AI.
The technology used to detect these flaws was from OpenAI. OpenAI has considered this flaw as a 'very serious security issue'.
What's wrong?
Most people probably haven't heard of PHP, but they probably use it every day.
The full name of PHP is Hypertext Preprocessor. It is an open-source, back-end programming language that runs on web servers.
It was developed in the early 1990s to create websites and applications whose content keeps changing. Even today it is used on many platforms. These include Wikipedia, online shopping websites and WordPress. WordPress is a content management system, which is used to create and run many types of websites including blogs.
Paul Spain, chief executive of Gorilla Cyber Security, told the BBC that when you go to a website like Wikipedia, PHP is the code that collects the information you need and presents it in a way that you can read on the website.
But a flaw was discovered in PHP that could allow attackers to take over the affected web server without any authentication and steal sensitive data. Because of this, everything built on PHP came in danger.
According to Spain, with the help of AI, carrying out such attacks can become easier and faster. They estimate that this flaw could affect "millions" of websites.
Jill Slay, a cyber security researcher at the University of Adelaide, said that if hackers or countries weaponized the flaw and obtained personal data from websites, the consequences could be "catastrophic".
Which websites are affected by this?
After this alert, many services have been affected across the world, from gaming platforms to government portals and online forums.
This also includes Wikimedia. This is the organization that operates the online encyclopedia Wikipedia. Wikimedia has shut down many of its systems as a precaution.
The Government of Finland, Edinburgh Council and the BBC have also taken some of their websites and pages offline. The Cyber Security Agency of the Netherlands has also closed its website.
Many government organizations in Scotland, including local councils and health boards, have also taken their websites offline as a precaution.
Some experts have warned that this flaw could put websites that are not properly maintained at greater risk. Websites of smaller organizations, in particular, may be at greater risk because they have limited resources for cybersecurity.
Salil Kanhere, a cyber security researcher at UNSW Sydney, said that attempts to take advantage of these flaws could increase in the coming weeks, because now the technical information related to these flaws is being made public.
What happened after the flaws were discovered?
The developers of the PHP platform released security updates on Wednesday to fix these flaws. These flaws had been present in their software for many years.
The company said, "All PHP users are strongly advised to update immediately." Authorities and cyber security organizations around the world have also appealed to website operators to secure their platforms.
The US National Security Agency asked all organizations using PHP to take their systems offline if they cannot immediately perform security updates. The agency said the flaw could provide a "direct path" to access a system's database.
The agency said, "These risks are so serious that it is necessary to immediately implement security updates across all US government agencies and departments."
Britain's National Cyber Security Center also gave similar advice. It asked organizations to check whether an attacker had created a "backdoor" in their systems.
Cyber security agencies of the European Union, Singapore and Australia have also issued similar alerts.
Japanese Prime Minister Sanae Takaichi urged people to check whether their publicly available websites are running on PHP or not. “We are urgently appealing to everyone to take action tonight,” Takaichi wrote on Twitter. He said that if it is difficult to immediately install security updates, then shutting down websites for some time and other such measures can be an effective way to reduce the risk.
Tech companies have also started trying to secure their systems.
E-commerce company Amazon said that a few days before this PHP problem became public, several attempts were made to target its system. However, it is not known how potential attackers became aware of this flaw in advance.
How is AI detecting vulnerabilities?
These flaws were discovered by researchers from cyber security companies Calif and Vis.
The researchers used advanced AI tools that can analyze computer code and find flaws much faster than humans or legacy systems.
Salil Kanhere, a cyber security researcher at UNSW Sydney, said: "Modern software is extremely complex and some flaws may go undetected for years."
He said, "The original flaws were not new. The only thing that has changed is that we now have the ability to find them."
The AI-assisted discovery of these vulnerabilities prompted PHP developers to quickly publicize their security alert and the extent of the problem, as information about the discovery was leaked online this week.
OpenAI said in a blog post that the incident "shows how AI can detect security vulnerabilities", but also noted that AI can "help attackers rapidly develop the tools and methods they use to carry out attacks."
OpenAI, the maker of ChatGPT, said it has released a program to check whether the PHP platform is secure.
Ryan Coe of the University of Queensland's Cyber Research Center said, "Many of these vulnerabilities are related to the way software was created in an era when the focus was more on functionality rather than security."
What can people do to keep themselves safe?
Website operators are being appealed to update their websites to the latest version of PHP.
Paul Spain, chief executive of Gorilla Cyber Security, said that for most technical teams this PHP security update is a small and common update.
The US National Security Agency has advised to "be more vigilant" in the coming weeks and closely monitor updates from software companies.
"The highest priority should be given to timely implementation of security updates related to these systems," the agency said.
Cyber security researcher Salil Kanhere said that the responsibility for this mainly lies with the website operators. However, users should also pay attention to any security advisories issued by affected websites or online services. For example, if a service asks you to change your password, then you should pay attention to it.
He also asked people to beware of phishing messages, which may try to defraud people by taking advantage of the publicity of this incident.
How big a concern for India?
This news is important for India because the Indian Computer Emergency Response Team i.e. CERT-In, which is the cyber security agency of the Government of India, has issued an alert regarding these flaws in PHP.
According to CERT-In, these PHP flaws have been kept in the "Critical" category. This means that if a server is running an affected version of PHP, an attacker can take advantage of this to remotely execute code on that system and gain a critical level of control over that system.
