- A key word is important right now, update your website because historical attacks are underway and it is powered by artificial intelligence. – As a consolation, we can say this is just the beginning. Governments in all countries are asleep, while over $10 trillion will be invested in data centers and artificial intelligence over the next five years.
“Now the cyber world is on alert, and for good reason.
Ole Gunnar Solskjaer revealed Manchester United’s biggest problem after they rejected Erling Haaland
The details of a critical weakness in the PHP programming language – the backbone of more than 70% of all websites – have now been published. The flaw could have made it easy for hackers to take over and compromise millions of websites and the information stored on their servers.
All the major banks in the United States have been attacked and there are rumors that accounts have been emptied. – Also here at home, companies, public organizations and private individuals are hit over a low shoe. – If you have not yet been attacked, update and change the password of everyone who has access.
In response, several European authorities and operators, among them the Port of Rotterdam, have taken their websites offline.
The Australian Signals Directorate, the US Cybersecurity and Infrastructure Security Agency and similar bodies in the UK, Europe and Japan have all warned web developers to implement urgent updates to their core systems – and consider taking down websites until security can be guaranteed.
The organization behind the free, open-source-based language has published updates that correct the bug, but getting the updates out on the millions of systems that use PHP will take time.
What is PHP?
PHP is often referred to as the “backbone of the web.”
It’s a programming language – a way of giving instructions to computers – that’s been around since 1997, and it allows websites to handle user input and process information behind the scenes.
The power of PHP lies in its versatility. Websites use it for everything from logging users into accounts and running online stores, to pulling data from databases and powering millions of blogs and news sites.
PHP runs on the server instead of on your personal computer. That means most of us use PHP every single day – without ever seeing it.
The timeline: From secret to leak
In August, cybersecurity researchers from the company Wiz used their own tools and the latest versions of Google’s Gemini and OpenAI’s ChatGPT to go through PHP’s vast codebase.
The Wiz team was looking for hidden programming weaknesses that an attacker could chain together to take over a system running PHP – simply by sending a carefully crafted request over the internet.
Within a few days, they found ways to break into PHP-powered systems from Drupal and WordPress, which are used in large parts of the web.
Wiz contacted the PHP security team to inform them of the bugs. At the end of September, the PHP developers confirmed that the problem existed, and quietly began working on a fix.
In cybersecurity, the responsible thing is to keep a bug private until a patch is ready – because disclosure can give hackers a detailed map to exploit.
That seems to have been the plan. But yesterday, a user on the popular industry website Hacker News released the news of the security flaws – before any updates were ready.
Following the leak, PHP’s developers rushed to publicly confirm the issue on October 21, releasing emergency updates ahead of schedule.
Far from easy to plug the hole
Implementing the patches is far from easy. Because PHP sits under thousands of third-party plug-ins, frameworks, and managed hosting services, websites are only secure when every single link in the supply chain integrates and deploys the PHP solution.
Why does this happen all the time?
Much of the internet is built on basic technologies that are developed and maintained by hobbyist developers. Many rely on goodwill and donations rather than solid business funding.
Many of these tools were first developed decades ago. They were never designed to safely support a world where millions of websites and billions of devices use them to handle sensitive and private data.
The problem is exacerbated by the fact that maintenance is rarely a priority for organisations. Too often, companies only have the most basic knowledge of all parts of their supply chains – whether physical or digital.
Even in high-profile cases like this, many companies aren’t even aware of what software they rely on – much less how secure it actually is.
What should you do?
This problem mainly applies to people who maintain websites or manage technical infrastructure. For them, the priority is clear: patch the systems immediately when updates are available, and consider disconnecting critical systems from the internet until you can be confident in their security.
For regular internet users, these vulnerabilities affect the servers that host web pages – not your personal device. However, since some websites can be temporarily compromised before they can be patched, it’s a good idea to be cautious about entering sensitive personal information into unknown websites over the next few days.
Major cloud providers and security firms are rolling out emergency filters, but the global race to secure the web is just getting started.
A wake-up call for the entire industry
Cybersecurity teams around the world are rushing to limit the damage. But the scale of this problem should be a wake-up call.
Governments and businesses cannot ignore the resilience of their digital supply chains. Just as manufacturers track the suppliers of the physical components they rely on, we should expect organizations to track every system and framework their digital infrastructure relies on.
Collecting this information is the first step for businesses and governments to truly understand how strongly their digital viability depends on underfunded, voluntarily maintained code.
Until companies treat funding basic open-source tools as a critical security investment rather than charity, these vulnerabilities will continue to occur.
Beetroot juice may lower blood pressure — but the benefits vary
