Governments and Amazon race to patch critical PHP flaws found with AI help
Sites running PHP may need to take systems offline until fixes are applied, as attackers were already probing the weaknesses before the public warning.
Governments and large companies including Amazon are racing to patch critical security flaws in PHP, the language behind a large share of websites, after the flaws were first found with the help of AI. Amazon said it was targeted in several attempts before the public warning was issued, and it could not establish how the attackers learned of the weaknesses. The UK's National Cyber Security Centre and counterparts in the EU and Australia told PHP users to apply fixes, and advised taking systems offline where patching is not immediately possible. Several public sites, including Dutch and Finnish government services and parts of Wikipedia, were taken offline as a precaution. The researcher who found the flaw called it the most serious vulnerability he has encountered, and a security firm estimated that roughly 70% of the internet is affected, a figure the BBC could not verify.
Why it matters
Owners of PHP-based websites now face a choice between patching quickly and taking services down, and public bodies have already chosen the second option as a precaution. Because the flaws give attackers a direct route into server files and databases, the exposure extends beyond the sites that are visibly down. Amazon's account that it was targeted before the warning, and that it could not tell how the attackers learned of the weaknesses, suggests the window for acting safely was narrow.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- BBC Technology