For more than ten years, the technology that supports the operation of a large number of websites on the Internet has been suffering from serious security vulnerabilities, but they have never been discovered.
It was not until artificial intelligence (AI) revealed these vulnerabilities that global cybersecurity alarms were triggered.
These vulnerabilities exist in a programming language called PHP. PHP has been widely used to build websites around the world since the 2000s.
Since the vulnerability was exposed on Wednesday (October 21), governments and cybersecurity agencies around the world are taking urgent measures to control the impact, urging website operators to install the latest emergency patches, otherwise they should consider temporarily shutting down the website.
Wiz, a cybersecurity company involved in discovering the vulnerability, described it as the "most serious" security flaw discovered by AI to date.
The technology that helps find vulnerabilities comes from OpenAI. The company said the discovery was "one of the most far-reaching cybersecurity issues in recent years."
What is PHP?
Most people have probably never heard of PHP, but they likely use this technology every day.
The full name of PHP is "Hypertext Preprocessor", which is an open source back-end programming language that runs on a web server.
PHP was developed in the early 1990s to help create dynamic web pages and web applications. Today, it is still widely used, including Wikipedia (Wikipedia), online stores, and the content management system WordPress used by many websites.
When you browse a website, the PHP program is responsible for getting the data and converting it into a web page that you can read.
PHP is also used to develop a variety of tools to help build web applications or speed up development. Laravel, Symfony and Drupal are all widely used PHP development frameworks or tools.
Wiz, the cybersecurity company that helped discover this week's major PHP vulnerability, noted that 70% of the world's websites use PHP.
PHP is maintained by the non-profit organization PHP Foundation. The organization, made up of individuals and businesses that rely on PHP, is committed to ensuring the programming language's "long-term sustainability."
What is the vulnerability?
Multiple cybersecurity researchers and organizations disclosed this week that PHP has two security vulnerabilities. They warned that the vulnerabilities could have a major impact on websites around the world.
Cybersecurity companies Wiz and Calif said that these vulnerabilities, collectively known as "php2shell", exist in the PHP programming language itself, and that multiple PHP versions released over the past decade are affected.
Ryan Austin, a Calif researcher who helped discover the flaw, told the BBC that it was "the most serious security flaw I have ever discovered."
Wiz pointed out in a blog post introducing the research results that under certain conditions, hackers can exploit the php2shell vulnerability to take control of the affected web server and steal sensitive data. This means that all websites built with affected PHP versions may be at risk.
Gorilla Cyber Security chief executive Paul Spain told the BBC that AI could also make it easier and faster for hackers to launch such attacks.
He estimated that the vulnerabilities could affect "millions" of websites.
Jill Slay, a cybersecurity researcher at the University of Adelaide, said if hackers or nation-states exploited these vulnerabilities to launch attacks and steal private data from websites, the consequences would be "catastrophic".
Which websites are affected?
This security alert has disrupted many online services around the world, including gaming platforms, government websites and online forums.
Those affected include the Wikimedia Foundation, the organization behind the online encyclopedia Wikipedia. To prevent risks, the foundation has temporarily shut down many of its systems.
The Finnish government, the City of Edinburgh Council and the BBC have all suspended some websites or web pages, and the Dutch cyber security agency has also closed its website.
A number of public bodies in Scotland, including local councils and health departments, have also temporarily closed their websites.
Some experts warn that sites that are not properly maintained may be at higher risk, especially smaller organizations with limited cybersecurity resources.
Salil Kanhere, a cybersecurity researcher at the University of New South Wales (UNSW), said that as the technical details of the vulnerabilities become public, more people may try to exploit these vulnerabilities in the coming weeks.
What happened after the vulnerability was exposed?
The PHP Foundation rolled out security patches on Wednesday to fix vulnerabilities that have existed in PHP software for years.
"All PHP users are strongly encouraged to update immediately," the organization said.
Governments and cybersecurity agencies around the world have issued similar warnings, urging website operators to take measures to ensure platform security.
The National Security Agency (NSA) of the United States requires all organizations that use PHP to temporarily shut down related systems if they cannot install patches immediately. The bureau pointed out that these vulnerabilities could allow hackers to "directly invade" system databases.
"These risks are severe enough to require all U.S. government departments and agencies to immediately install patches," the agency said.
The UK's National Cyber Security Center (NCSC) has made similar recommendations and asked organizations to check systems for "backdoors installed by attackers".
Relevant cybersecurity agencies in the European Union, Singapore and Australia have also issued similar alerts.
Japanese Prime Minister Takaichi Sanae called on the public to check whether their public websites use PHP.
Sanae Takaichi posted on the social platform X: "We urgently call on everyone to take action tonight."
She said: "If it is difficult to install the patch in time, you can consider measures such as temporarily shutting down the website. This is also an effective way to reduce risks."
Technology companies are also trying to quickly strengthen system security.
E-commerce giant Amazon said that days before the PHP vulnerabilities were publicly disclosed, the company had encountered multiple attack attempts targeting the vulnerabilities, but its website had been operating normally.
Matthew Prince, CEO of network infrastructure company Cloudflare, also said that the company's network had recorded "thousands" of attack attempts using PHP vulnerabilities in the 10 hours before the vulnerability was officially announced.
He posted on
How can AI help find vulnerabilities?
The Calif and Wiz researchers who discovered these vulnerabilities used advanced AI tools that can analyze program code and find vulnerabilities far faster than humans or legacy systems.
"Modern software is extremely complex, and some vulnerabilities may go undetected for years," Canhere said.
"Errors in the program itself are not new, what has changed is our ability to detect them," he said.
Details of the discovery leaked online this week, forcing PHP developers to rush to announce the security flaw and its massive scope in advance.
OpenAI stated in a blog post that this incident "highlights how AI can discover security vulnerabilities," but it also shows that AI can "assist attackers in quickly developing attack tools and methods to exploit vulnerabilities."
The ChatGPT developer said it has launched a tool to help check whether the PHP platform is safe.
"Many of these vulnerabilities stem from the way software was developed in the past," said Ryan Ko of the University of Queensland's Cyber Research Center. "At that time, developers focused on software functionality without fully considering security issues."
How does this affect you?
These vulnerabilities involve the website back-end and web development process and will not be directly exposed to ordinary users, so most people do not need to take any action.
However, small businesses with websites, including those using WordPress to build their websites, may be wondering how to protect themselves.
The UK's National Cyber Security Center recommends that if updates cannot be installed in time or temporary protective measures can be taken, a temporary shutdown of the website should be considered.
The U.S. National Security Agency also called on all walks of life to "increase vigilance" in the coming weeks and pay close attention to updated information released by software vendors.
"It is crucial to remain vigilant on relevant systems and install patches in a timely manner," the bureau said.
Canhere said that while the responsibility for ensuring website security falls primarily on website operators, general users should also pay attention to security advisories issued by affected services, such as notifications requiring password changes.
He also warned that the public should be wary of anyone taking advantage of the attention this incident has caused to send phishing scam messages.
