Summary:
Cybersecurity researchers used AI to uncover two critical vulnerabilities in the PHP language code that have been present for almost a decade.
The flaw in the code could impact up to 70% of the world’s websites, potentially allowing attackers to take over websites and steal sensitive information saved on affected servers.
Small business owners and website managers have been urged to secure their websites by updating to the latest PHP version.
What was discovered?
Last week, cybersecurity researchers uncovered two critical vulnerabilities hidden within PHP's codebase. Simply put, PHP is a programming language that powers over two-thirds of the world’s websites.
The flaws, uncovered by Wiz Research, had reportedly existed for almost ten years without being detected. Wiz said the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.”
Despite existing for years, exploiting these two issues would have been extraordinarily complicated for human researchers. An advanced system of OpenAI’s ChatGPT was used by the researchers to analyse the code and locate the flaws.
The use of artificial intelligence to help uncover the vulnerabilities raises fresh questions about how AI could challenge existing cybersecurity defences and potentially contribute to more sophisticated cyberattacks in the years ahead.
Which websites and services are affected?
The vulnerability was published online on October 21, causing widespread disruption as government agencies and companies around the world pre-emptively took down sections of their websites so they could fix the issue.
For website owners, popular CMS platforms like WordPress and Drupal run on PHP, meaning millions of websites around the world could be affected if they remain unpatched.
Some Department of Justice Ireland websites were temporarily taken down after the October 21 announcement “due to essential works”. (Source: Department of Justice Instagram)
How does this impact your website?
Once security issues like these become public knowledge, attackers often begin looking for websites to exploit that have yet to be updated with a fix.
This vulnerability is particularly worrying as attackers could potentially gain complete access to your website and any sensitive information stored on it. In severe cases, it could leave website owners without access to their own websites. Once access to your website has been lost, it can become extremely difficult (and incredibly expensive) to try and recover.
Critical PHP vulnerabilities can also impact your SEO. Apart from taking down your website, attackers can inject malicious code to steal visitor information, redirect users to malicious websites, and upload spam or explicit content on your pages. These attacks could result in a spam penalty against your website, causing your website to lose visibility in search results or be removed from Google altogether until the issue is resolved.
What should website owners do about the PHP vulnerability?
1. Check your PHP version
As this vulnerability affects websites at the server level, the most important step is to verify that your hosting provider is running one of the security-patched PHP versions of 8.2 or newer.
If you are using PHP 8.1 or older, ask your hosting provider to upgrade to PHP 8.2 or newer as soon as possible.
2. Update your website
Website owners should also update their website to the latest supported version of PHP. If you are running a website on WordPress, ensure:
Your WordPress version is up to date (6.6 or later) and
All plugins are updated to their latest versions
For small business owners, this PHP vulnerability is an important reminder that website maintenance shouldn't be treated as a one-off project. Regular security and plugin updates play a critical role in maintaining your marketing performance and safeguarding business operations from emerging threats.
