Globally, numerous websites have been taken offline after artificial intelligence discovered serious vulnerabilities in the popular programming language PHP. Organizations worldwide are rushing to protect themselves from potential hackers.
As rapidly evolving AI capabilities heighten concerns about the rise of cyberattacks, answers have been provided regarding the current situation.
What is PHP and how widely is it used?
PHP, created in the early 1990s, is a programming language that helps power approximately 70% of the world's websites. According to security firm Wiz Research, PHP serves as the 'foundation of the internet,' and this firm has used AI to detect hidden vulnerabilities in PHP for over a decade.
PHP, whose name originally stood for Personal Home Page, underpins popular web design platforms. This means that the discovered flaws could allow attackers to penetrate various resources, including government services and online stores.
A fix was released on Wednesday, after which the PHP Foundation strongly recommended that IT departments of companies and organizations globally update their systems. Consequently, many applications and sites, from the Paris police website to the Pokemon sleep tracker, stopped working while developers worked to secure their code against hacking.
How did AI discover the vulnerabilities?
Advanced AI models, such as those developed by American giants OpenAI and Google, were utilized by Wiz and other groups to identify weaknesses in PHP in August. This information remained confidential while the fix was being developed.
OpenAI called these vulnerabilities 'some of the most significant issues recently,' noting that it 'opens a new phase where AI is capable of finding security errors with global impact on the internet.' Separately from Wiz, the security firm Calif discovered these flaws during an OpenAI-funded audit of PHP code.
Steve Kerrison, a senior lecturer in cybersecurity at James Cook University in Singapore, told AFP: 'The problem with tools like AI is that once all the information becomes public, people can very quickly use it as a weapon.' He added that this is precisely why everyone is acting so urgently in response to this issue.
Have websites already been hacked?
Dimitrios Salampasis from Swinburne University of Technology in Australia noted that 'website downtime does not necessarily mean they were hacked. It could be a defensive measure to protect systems while security updates are applied.'
According to Kerrison, there is currently 'no evidence that security researchers have observed active attacks using the available methods.' Large institutions, including news agencies and government bodies, should be able to resolve issues with their websites relatively quickly, but some may remain unprotected.
Kerrison warned that there are websites, systems, and individuals who might not know about this for days, weeks, or months. Such entities could include user-managed blogs, which can be used to spread computer viruses, spam, or distribute malicious content.
Could there be other consequences?
In the future, data leaks could affect customers if their personal information is used in so-called 'phishing' attacks, where a person is tricked into revealing their password to an online service.
The complex and interconnected nature of online systems, which often use third-party interfaces, means that some vulnerabilities may persist even after the initial problem is resolved. Rahat Masud, a senior lecturer in cybersecurity at the University of New South Wales in Sydney, stated that if third-party services use PHP, then 'even if you fix the problem yourself... you are still vulnerable.'
Nevertheless, PHP is not everything; Kerrison emphasized that robust cybersecurity measures must include multiple layers of defense.