Vulnerabilities
A major PHP flaw puts millions of websites at risk of attack
A newly discovered vulnerability in PHP could let attackers break into websites, steal data, and plant malware. Website owners must patch their systems, but users should stay alert for scams and data breaches.
Ross Grant3 min read
The short version
A newly discovered security flaw in PHP, the software behind most websites, could let attackers break into sites and steal data. Website owners need to update their systems to stay safe. If you use the internet, keep your passwords strong and watch out for scam emails. There is no need to panic, but stay alert for suspicious activity.
By the numbers
- 70%of websites use PHPThe New York Times
- 1 weektime since the flaw was discovered and patchedThe New York Times
What happened?
A serious vulnerability was found in PHP, a programming language used by about 70% of websites. The flaw could let attackers break into sites, steal data, or plant malware. The PHP Foundation has released patches, and website owners are urged to update immediately. No confirmed attacks have been reported yet, but attempts to exploit the flaw increased before the patch was released.
Who is affected
According to The New York Times (opens in a new tab), the vulnerability affects websites that use PHP, a programming language that powers about 70% of all sites online. This includes online shops, news sites, school portals, and small-business pages. Anyone who owns or manages a website built with PHP is potentially at risk. Users of these sites could also be affected if attackers steal data or use compromised sites to spread malware.
How the flaw works
Researchers found a vulnerability in PHP that could let attackers access a website’s internal systems. With this access, attackers might steal sensitive information, create backdoors (hidden ways to get back in later), or plant malware. The flaw is especially serious because PHP is so widely used. As Martin Zugec from Bitdefender explained, it is like discovering that a common lock on millions of doors can be picked. However, Bitdefender said they have not yet seen real-world attacks using this flaw.
The response
The PHP Foundation released a series of patches this week to fix the problem. Many websites, including government portals and online stores, went offline temporarily as a precaution. Attempts to exploit the flaw increased just before the patch was released, according to The New York Times. There are reports that a video showing how to exploit the flaw is circulating online, but no confirmed attacks have been seen so far.
What you should do
If you run a website, check with your hosting provider or the official sites for platforms like WordPress, Drupal, Joomla, or Magento to see if you need to update. Apply any relevant security patches immediately. Be careful to follow only trusted sources for update instructions, as scammers may try to take advantage of the confusion.
For regular users, you do not need to change all your passwords or stop using websites. Instead, use unique and complex passwords for each account, store them in a password manager, and enable two-factor authentication where possible. Be wary of emails claiming a company has had a data breach and asking you to click links, as scammers often use news of vulnerabilities to trick people.
What experts say
Experts quoted by The New York Times warn that criminal groups known as initial access brokers may try to exploit this flaw to break into servers and sell access to other criminals, including ransomware gangs. Cooper Quintin from the Electronic Frontier Foundation said this could lead to data breaches or even ransomware attacks months later. Chris Fistonish from Malwarebytes urged website owners to update immediately and for everyone to keep up good security habits.
The flaw also highlights how much of the internet relies on open-source software like PHP, which is maintained by a small group of volunteers. Experts say more investment is needed to keep these critical systems secure.
Claimed vs confirmed
- Unconfirmed
Attackers are already exploiting the PHP flaw in the wild.
Bitdefender told The New York Times they have not yet seen real-world attacks using this vulnerability.
Why it matters
This flaw could let criminals steal data or plant malware on millions of websites. Even if you do not run a website, your personal information could be at risk if sites you use are compromised. The incident shows how much of the web depends on open-source software that is not always well funded or maintained.
Key points
- A major PHP vulnerability threatens millions of websites.
- Website owners must patch their systems immediately.
- No confirmed real-world attacks yet, but attempts have increased.
- Users should use strong passwords and watch for scams.
- The flaw highlights the risks of underfunded open-source software.
Sources
Wired
Reference
The New York Times
Reference
