There is an uproar on the Internet regarding PHP. Artificial Intelligence (AI) has discovered a major cybersecurity flaw that has existed in a popular programming language called PHP for almost 10 years. As soon as this flaw was discovered, on Thursday i.e. on October 22, many websites and online services around the world had to be closed so that hackers could not misuse them. PHP is used to run and create a large number of websites in the world. In such a situation, the impact of the security loophole found in it can reach from government websites to online stores and other digital services.
Cybersecurity agencies and governments have advised organizations running websites to install security updates as soon as possible. This is the reason why some organizations took precautions and temporarily closed their websites. But the question is what is PHP? Which such mistake has been found in it which poses a threat to thousands of websites? After all, how did AI discover this flaw? Let us understand all these questions.
PHP is used to create and run a large number of websites around the world.
What is PHP and where is it used?
We use many websites on the Internet every day. What technology works behind running these websites? One such technology is PHP, which is used to create and run a large number of websites around the world. Actually, PHP is a programming language and it is used to create websites and the systems that run behind them. That is, when you login to a website, search for information or buy goods online, technology like PHP can help in completing these tasks on the server.
PHP originated in the 1990s and is free and open source. It is also relatively easy to learn and that is why it has been popular for a long time. According to cyber security company Viz Research in a Firstpost report, about 70 percent of the world’s websites use PHP in some form or the other. Therefore, the impact of a serious flaw found in it can be very wide. The full name of PHP was earlier Personal Home Page. Now PHP is officially considered a recursive acronym, whose full name is PHP: Hypertext Preprocessor.
What error was found in PHP, due to which the websites had to be shut down?
Cybersecurity researchers discovered two serious security flaws in PHP. These are called Remote Code Execution (RCE) i.e. flaws related to remote code execution. This flaw is such that if there is a lack in the security of your computer, if some unknown person sitting at a distance starts running code on your computer as per his wish. That too when it does not require any password or permission to enter the system. There was a similar risk due to the flaws found in PHP. Taking advantage of these, hackers could send specific requests to any server and try to run the code of their choice there. This could create a threat of gaining control of the website, accessing data or causing damage to the system. According to the latest report, these vulnerabilities were present in the PHP code for more than 10 years, but were not known until now.
Why are websites being closed all over the world?
As soon as these security flaws were discovered, organizations running websites faced the challenge of securing their systems. On October 21, a security update for PHP was released. The PHP Foundation advised organizations and companies to install the update as soon as possible. But securing a large website is not as easy as pressing a button. Developers have to check which version of PHP the website is running on and whether the website is working properly after installing the update.
For this reason, some organizations took their websites temporarily offline. That is, the facility for people to open their website was stopped, so that security checks and necessary changes could be made. Wikimedia, some government websites in Finland, and several public services in Scotland have closed their websites or pages. The Cyber Security Agency of the Netherlands also took precautionary measures.
How did AI discover this PHP flaw?
Wiz and other research teams examined PHP code with the help of AI models and discovered vulnerabilities that had gone unnoticed for a long time. Cyber security company Calif also identified flaws by auditing PHP code with funding from OpenAI. Typically, cybersecurity experts examine software code, look for potential mistakes, and see how an attacker could take advantage of those mistakes. Testing large amounts of code is a lengthy process. OpenAI described these flaws as one of the most significant security vulnerabilities of recent times. According to the company, this indicates that AI can now help in finding serious security flaws in widely used software.
When information about a serious flaw becomes public, cyber criminals may also try to take advantage of it. Steve Kerrison, a cyber security expert at James Cook University in Singapore, told AFP that once information related to tools like AI comes to light, people can misuse them very quickly.
According to cyber security experts, in such cases, organizations running websites should take some important steps:
– Check whether the affected version of PHP is being used or not.
– Install official security updates and patches as soon as possible.
– Also check the third-party services and software associated with the website.
– Monitor server logs and security alerts to detect any suspicious activity.
– If there are signs of system compromise, investigate and, if necessary, change affected passwords or access credentials.
Experts say that updating just one software is not enough for strong cyber security. For this, many layers of security are necessary. These include regular updates, access control, monitoring, backup and rapid response in case of an attack.
