Cybersecurity experts are concerned about countless websites that may be exposed to cybercriminals after a critical security issue was identified in a popular programming language.
On Oct. 20, the PHP Foundation disclosed two critical security issues found in PHP, a popularly used, open-source server-side scripting language used to develop around 70% of the world's websites. Due to the vulnerability, uncovered by security researchers this summer, hackers could take control of or disrupt websites and access sensitive user information.
OpenAI, Google and Calif completed a patch to fix the bugs in early October, but websites that run on PHP will need to update and install the patch individually.
Cybersecurity firm Cisco Talo estimates that about 50%
of all PHP systems around the world will not receive an official patch for the newly discovered security issues because older websites rely on unsupported versions of PHP, so there is no easy way for them to be updated.
The National Security Agency notified organizations running on PHP software on Oct. 21 to take their systems offline if they cannot immediately update their services with the patch.
As developments unfold, here's what to know about the PHP security issues.
What is PHP?
Standing for PHP: Hypertext Preprocessor, PHP can generate dynamic page content; create, open, read, write and delete files on a server; collect form data; send and receive cookies; add, delete or modify data in a database; and encrypt data, according to educational computing site W3Schools.
Some of the world’s most popular websites use PHP, including WordPress, Facebook, Wikipedia, Slack, Etsy and Upwork, according to software development agency Trio. And countless more are built on WordPress, including the White House and NASA websites.
When was the critical security issue identified?
The security issue was first caught in July by researchers at digital infrastructure defense firm Calif who were working in collaboration with OpenAI's Patch the Planet initiative, according to OpenAI. Google's Wix cybersecurity team also discovered and reported the vulnerabilities in August.
How are the issues being fixed?
Calif security researcher Bruce Dang said OpenAI, Google and Calif completed the patch a few weeks ago but the organizations have been testing it before releasing it to the public.
"You don't want to release the patch to the public too early," Dang said. "Because as soon as it goes out, other people, other security researchers and other hackers are going to be able to reverse engineer that patch."
The patch was supposed to go public on Thursday, Oct. 22, but Hacker News leaked information about it two days in advance, so the patch was released on Wednesday, Oct. 21, instead.
What is the US government doing?
The Trump administration was notified of the critical security issue on Friday, Oct. 16. In a statement, the White House said the administration is working with federal agencies and AI companies to "expedite the release" of the patch to users to protect American networks and critical infrastructure.
Does the security issue impact everyday internet users?
The critical security issue does not affect consumers' phones or browsers directly, but rather services they may use everyday like online stores, government websites or personal blogs, Cloudflare Director of Project Management Daniele Molteni told USA TODAY.
Checkmarx research advocate Darren Meyer added that banking, shopping and health care apps can be vulnerable to hackers amid security issues like this one.
Everyday internet users are urged to take the following steps to protect themselves:
- Remain vigilant for unprotected sites that could be compromised by cybercriminals.
- Stick to trusted sites and watch for unexpected emails, texts or messages claiming to come from the websites you frequent.
- Enable two-factor authentication on important online accounts such as email and banking.
- Keep your operating system and browser updated.
- Heed warnings from your web browser if it blocks a site as a security risk and leave the page immediately.
- Website owners should log into their web hosting control panel or contact their hosting provider immediately to confirm that servers have been updated to the latest patched version of PHP.
Greta Cross is a national trending reporter at USA TODAY. Story idea? Email her at gcross@usatoday.com.
This article originally appeared on USA TODAY: A basic explanation of the 'critical' PHP flaw
