TECH UPDATE: THREAT DISCOVERED, PHP PROGRAMMING LANGUAGE TERMED VULNERABLE TO HACKERS

Inventors of the PHP programming language on Wednesday released urgent new fixes, opens new tab to vulnerabilities that had been lurking ‌in their software for years which has caused government websites in Europe and other countries to go offline on Wednesday after the disclosure.

 The generally used programming language sent website operators around the world scrambling to protect their systems. These weaknesses were uncovered using AI, saying all users were "encouraged to update it immediately.

With tech firms warning that some hackers were already exploiting the flaws, government agencies across Europe were among those that took sites offline as a precaution. Because a fix is now public and artificial intelligence tools are able to reverse engineer the bug with little effort, experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of the updates.

According to data from censys, the internet intelligence firm, about 1.5 million out of 2.6 million hosts report running a version of PHP for which there is no fix.

The Dutch cyber security agency itself went offline, saying it had done so as a precaution because of the vulnerabilities.

 ​The operator of the online compendium Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched, while internet archive, the extensive online library, said it also briefly went offline to deal with the issue.

The vulnerability allows a hacker to change a website or extract data, including personal information.

PHP runs on the servers that host websites, building pages behind the scenes before they reach a visitor’s browser. Most people never see it, but it powers everything from blogs to online shops and government portals.

Experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of the updates. Both flaws stem from how PHP handles fatal errors, such as running out of memory. Because the problem sits in PHP itself, even the simplest website running an affected version can be vulnerable, and attackers could read passwords and other credentials from a server’s memory, the cloud security company wiz said. Both flaws scored 9.2 out of 10 on the industry’s standard severity scale, placing them in the “critical” category.

The two flaws, nicknamed PHP2shell, were found independently by two cybersecurity companies using AI. Calif, working with OPEN AI, reported the first on august 11. Wiz, which is owned by Google, reported the second on august 24.

Calif said that while ai was getting better at cybersecurity, it was also getting better at being a hacker. “This means that we are developing systems … that are making the internet safer by helping to fix bugs, but we’re also making it riskier by discovering bugs and creating bugs they’ll be able to hack.

he added that“there is concern in the cybersecurity community about what the blast radius for this will be, even though the developers of PHP have been very quick to try and develop patches for it.” the PHP foundation released two patches designed to fix the vulnerabilities.