Artificial intelligence has found serious security flaws in PHP, a programming language used by most websites in the world. Many websites were taken offline on Thursday while their owners rushed to install a fix.
PHP was created in the early 1990s. It helps run an estimated 70 percent of the world’s websites, according to IOL, which carried the AFP report.
The PHP Foundation released a fix on Wednesday. It sent a clear message to tech teams at companies and organisations around the world. “If you run PHP, it is imperative that you update now,” the foundation said.
Security firm Wiz Research said it used AI to find weak spots that had been hidden in PHP for more than ten years. The firm called PHP “a backbone of the web”.
Wiz and other groups used advanced AI models, including some from US companies OpenAI and Google, to find the flaws in August. The problem was kept secret while a fix was built.
Another security firm, Calif, found the same flaws on its own. It was doing a check of PHP’s code that was paid for by OpenAI.
OpenAI called the flaws “one of the most impactful vulnerabilities in recent memory”. The company said it “marks a new phase, where AI can find security bugs with internet-scale impact”.
PHP sits under many popular website building tools. This means the flaws could let hackers break into many kinds of sites, from online shops to government services.
Many apps and websites went dark as developers worked to protect their code. These ranged from the Paris police website to a Pokemon sleep tracker.
“The trouble with tools like AI is that the moment all the information’s out there, people can weaponise it very, very quickly,” Steve Kerrison told AFP. Kerrison is a senior lecturer in cybersecurity at James Cook University’s Singapore campus.
“That’s why everybody’s acting with such urgency to respond to this issue,” Kerrison said.
Kerrison said security researchers had so far seen no proof that anyone was using the flaws to attack websites.
Dimitrios Salampasis from Swinburne University of Technology in Australia said a website going offline does not mean it was hacked. “It can be a responsible measure to protect systems while security updates are applied,” Salampasis said.
Big organisations, such as government agencies and news outlets, should be able to fix their sites quite quickly, according to the report. Smaller site owners may be left exposed for longer.
“There are sites, systems and people out there who will have no idea about this and still won’t for days, weeks and months,” Kerrison said.
Blogs run by ordinary users could be used to spread computer viruses, send spam or share harmful content, the report said.
Customers could also be hurt later if their personal details are stolen in a data breach. Criminals can use such details in phishing attacks, where people are tricked into giving away their passwords.
Online systems often depend on outside services. This means some weak spots could remain even after a website owner installs the fix.
If those outside services also use PHP, “then even though you patched yourself… you’re still unsecure”, said Rahat Masood. Masood is a senior lecturer in cyber security at the University of New South Wales in Sydney.
Kerrison said strong online security should use several layers of protection, not depend on PHP fixes alone.
Source: this article is based on reporting by IOL Technology. Image: IOL Technology. Written with the help of AI and published by the Tzaneen Voice Technology desk. See our Editorial Standards.
Werner Jacobs covers technology for Tzaneen Voice. Werner reports on mobile networks, data prices, internet access, smartphones, apps, AI, cybersecurity and South African tech companies. Each story explains what a new product, price change or policy means for ordinary users in South Africa.