According to the BBC, serious flaws that went unnoticed for more than a decade in PHP, a programming language underpinning much of the internet, have been brought to light with the help of artificial intelligence. Since the disclosure on Wednesday, governments and cyber-security agencies worldwide have been scrambling to contain the fallout.
What is PHP?
PHP is an open-source language that runs on web servers, gathering data and turning it into the pages people read. Wikipedia, online shops and WordPress run on it. Cyber-security firm Wiz says PHP powers 70% of the world's websites.
How serious is 'php2shell'?
According to Wiz and Calif, the flaws, dubbed "php2shell", are inherent in the language itself and affect versions released over the past decade. Wiz says that under the right conditions attackers could take control of affected servers and steal sensitive data. It called them the "most severe" flaws ever found by AI, while OpenAI, whose technology was used in the discovery, described it as one of the most impactful security issues in recent memory.
Sites taken offline
The BBC reports that Wikimedia took several systems down as a precaution, and the Finnish government, the Netherlands' cyber-security agency and a number of Scottish public bodies pulled websites offline. Experts warn exploitation attempts are likely to rise in the coming weeks as technical details become public, with smaller organisations' poorly maintained sites most at risk.
Patch now
The PHP Foundation released patches on Wednesday and urged all users to update immediately. The US National Security Agency told organisations that cannot patch at once to take systems offline, while the UK's National Cyber Security Centre advised checking for backdoors installed by attackers. Agencies in the EU, Singapore and Australia have issued similar alerts.
Given how many Pakistani websites run on WordPress and PHP, the warning is directly relevant to local site owners too.