Last Week’s Critical PHP Warning Was the Tip of the Web Vulnerability Iceberg

AI is finding new holes in the infrastructure of the internet. Is anyone around to patch them?

For the past week, software engineers around the globe have been scrambling to update the backend of websites after a team using an OpenAI model discovered two major vulnerabilities in PHP, a critical piece of web software.

PHP, open-source scripting software that underpins as many as 70% of websites worldwide, can become outdated when website owners don't update to newer versions of the software, making them vulnerable to attacks. Shortly after alerts were issued about the new vulnerabilities, new versions of PHP were issued, and site operators were urged to update.

Some government websites went dark in Europe as these updates were applied, but for much of the web, it's been left to individual website owners to apply the fixes. But will they? More from CNET No law compels them to do so, although if a website suffers a data breach, the owner could be liable to customers or clients.

And for web surfers, it's not obvious what PHP version a site is running without running terminal commands or using an online PHP checker. Given that some websites are no longer actively managed - I own a website that was latent and hadn't had a PHP update or updates of its WordPress software in years, for instance - the PHP story has shown that the web's aging architecture is proving to be insecure due to neglect and dwindling resources to keep it safe.

PHP security shortages

One of the most shocking revelations that has come out of the last week's race to get websites updated and safe is that an organization tasked with making sure security flaws in PHP are addressed is itself on shaky ground.

Reuters reported that the PHP Foundation, a nonprofit formed in 2021 to work with researchers and cybersecurity companies to ensure a crisis like this wouldn't happen, has only one full-time staff member and lacks the resources to expand.

The Foundation's Executive Director Elizabeth Barron told Reuters that she's the sole staff member and works with about 14 part-time contractors and unpaid board members. As AI-generated threats increase, there's twice as much demand to change PHP code to address them as in the past.

"Yet the number of contributors hasn't doubled," Barron said. While companies and governments rely on PHP, "It is clear PHP is severely underfunded," she said. A representative for PHP Foundation did not immediately return a request for comment.

Website operators may be unaware there's a problem

Nearly all small businesses have some sort of web presence, whether it's a social media account, a Google listing or a website they own. But small business owners, a survey from Network Solutions found, may not be addressing the PHP issue because they don't know it affects them.

The report, based on a survey of 121 small business owners with their own websites, found:

• 45% of them had never heard of PHP and 71% didn't know if their websites use it.
• A large majority of 71% of these site owners hadn't heard about the recent PHP flaws.

Rick Radinger, principal systems architect for Network Solutions Group, said that the survey showed awareness and knowledge gaps, but that in addition to not knowing about the current PHP problem, they may not think it's their responsibility to act on a fix.

"An owner might know about the warning but could assume their hosting provider will handle it," Radinger said. "Others might need additional help but aren't sure who to contact or next steps."

Some of the mobilization about the PHP alerts included updates from large web infrastructure companies like Cloudflare and web hosts such as GoDaddy. In a blog post, Cloudflare said it deployed new web application firewall protections to detect and fend off attacks. GoDaddy made updates to its managed hosting and Windows hosting services that didn't require website owners to take extra steps, but said that domain customers who manage their own sites or run virtual private servers may need to update PHP themselves.

Frustration for web users

For those who don't own a website, the PHP vulnerabilities aren't something you can protect against by updating your passwords; it's up to websites to stay updated to protect their visitors.

"For users, it is frustrating that they can't fix this, as it is an issue with the site's server, not the browser," Radinger said. "Simply updating your browser doesn't address the issue, and a site being up and running normally does not mean the site has been fixed."

The usual advice applies more than ever:

• Be careful about clicking on unfamiliar website links,
• Don't share sensitive information with websites you don't trust and
• Be especially cautious about links that will download software to your device.

The PHP crisis is a good wake-up call about what's happening to the World Wide Web as it approaches its fourth decade of operation. This latest security scramble is just one of the threats websites face (AI-generated breaches are a huge one).

But many of the dangers to come may stem from aging digital architecture; PHP is just one of myriad tools websites use, including JavaScript, SQL databases, content management systems (like WordPress or Wix), and the software that the servers themselves run. If those aren't regularly monitored, managed and updated across the web, you can expect a lot more vulnerabilities to emerge in the years to come.