Details have been published of a critical flaw in the programming language PHP, which is the backbone of more than 70% of all websites. Left unfixed, the flaw would allow hackers to easily take over and compromise millions of websites and the information held on their servers. In response, multiple European governments and operators, including the Port of Rotterdam, have taken websites offline.
The Australian Signals Directorate, America’s Cyber Defence Agency, and similar bodies from the United Kingdom, Europe and Japan have all warned web developers to apply urgent updates to their core systems, and to consider taking down websites until safety can be guaranteed.
The organisation behind the free, open-source language has published updates that patch the flaw, but performing the updates on the millions of systems that use PHP will take time.
What is PHP?
PHP is often called “the backbone of the web”. It’s a programming language – a way to give instructions to computers – that has been around since 1997, and it allows websites to manage user inputs and process information behind the scenes.
The power of PHP is its versatility. Websites use it for everything from logging users into accounts and running online stores to requesting data from databases and powering millions of blog posts and news sites.
PHP runs on the server rather than your personal computer. This means most of us interact with PHP every single day without ever seeing it.
A timeline of concerns
In August, a cybersecurity researchers from a company called Wiz used their own tools and the latest versions of Google’s Gemini and OpenAI’s ChatGPT AI models to trawl through PHP’s massive codebase.
The Wiz team were searching for hidden programming weaknesses that an attacker could chain together to take over a system running PHP simply by sending a carefully crafted request over the internet.
Within a few days, they found ways to break into PHP-powered systems from Drupal and WordPress which are used in huge swathes of the web.
Wiz contacted the PHP security team to let them know about the flaws they had found. By late September, the PHP developers confirmed that the issue existed, and quietly began working on a fix.
In cybersecurity, the responsible thing to do when you find a bug is to keep it private until a patch is ready. This is because public disclosure could provide a detailed map for hackers to exploit.
This appears to be what the PHP developers were planning. However, yesterday a user on the popular industry website Hacker News let news slip about the security flaws before any patches were ready.
Following the leak, PHP’s developers rushed to publicly confirm the issue on October 21, releasing emergency patches ahead of schedule.
Implementing the patches is far from simple. Because PHP sits underneath thousands of third-party plugins, frameworks and managed hosting services, websites are only secure once every individual layer of the supply chain integrates and deploys the PHP fix.
Why does this keep happening?
Much of the internet is built on foundational technologies that were developed and maintained by hobbyist developers. Many rely on goodwill and donations rather than robust corporate funding.
Many of these tools were first developed decades ago. They were never designed to safely support a world where millions of websites and billions of devices use them to handle sensitive and private data.
Compounding this issue is the fact that maintenance is rarely a priority for organisations. All too often, companies have only the most basic knowledge about all the pieces of their supply chains – either physical or digital.
Even in high-profile cases such as this one, many businesses don’t even realise what software they depend on, let alone have any idea of how secure it actually is.
What should you do?
This issue is mainly one for people who maintain websites or manage technical infrastructure. For those people, the priority is clear: patch systems immediately when updates are available, and consider taking down critical systems from the internet until you can be confident about their security.
For everyday internet users, these vulnerabilities affect the servers hosting websites rather than your personal device. However, because some sites may be temporarily compromised before they can patch, it is wise to be cautious about entering sensitive personal data on unfamiliar websites over the next few days.
Major cloud providers and security firms are rolling out emergency filters, but the global scramble to secure the web is just beginning.
Cybersecurity teams around the world are rushing to contain the damage. But the scope of this issue should be a wake-up call.
Governments and businesses cannot ignore the resilience of their digital supply chains. Just as manufacturers track the suppliers of the physical components they depend upon, we should expect that digital infrastructure also traces every system and framework it depends on.
Gathering this information is the first step for businesses and governments to truly understand how heavily their digital viability relies on underfunded, volunteer-maintained code. Until businesses treat funding open-source foundational tools as a critical security investment rather than a charity, these vulnerabilities will keep happening.
- is a Guest Research Fellow, School of Computing and Information Systems, The University of Melbourne
- This article first appeared in The Conversation
