Global Internet infrastructure has a fatal vulnerability that has gone unnoticed for decades until recently surfaced with the help of artificial intelligence (AI) technology, triggering a global cybersecurity alert. So, what impact does this widely discussed security incident have on ordinary Internet users?
On Wednesday, researchers disclosed a critical vulnerability in the PHP programming language, prompting a similar warning from the FBI’s cyber division in the United States and sending governments, businesses, and various organizations into a frenzy.
PHP is a widely used general-purpose scripting language mainly used for web development, powering a vast majority of websites worldwide, from Wikipedia to various government agencies without exception.
Cloud security platform Wiz is one of the companies that discovered this vulnerability, estimating that up to “70%” of the Internet is affected.
The “PHP Foundation,” dedicated to ensuring transparency and accountability of the language, warns that these vulnerabilities could be exploited maliciously, allowing attackers to access PHP-powered websites without authorization.
Cybersecurity experts further warn that as more details of this vulnerability are made public, there may be a wave of hacker attacks in the coming weeks, putting personal data at risk.
Thai Duong, head of the company Calif involved in discovering the vulnerability, told the Daily Mail, “The reality is that there is very little that ordinary Internet users can do.”
“Do people need to worry? Indeed, they do, but there’s no need to panic. The responsibility lies with the website operators, hosting service providers, and the entire cybersecurity industry,” he said.
Wiz and Calif are part of the “Patch the Planet” project and collaborating with OpenAI; the project’s goal is to search for such core vulnerabilities.
Here is a comprehensive report from the Daily Mail introducing this cyber security storm, its potential impact on you, and how you can respond.
PHP (Hypertext Preprocessor) is a core Internet technology that has been widely used globally since the early 21st century and is deeply embedded in various corners of the modern Internet.
Whenever a user visits a website, PHP is responsible for collecting the information the user needs and presenting it on the webpage in a readable format.
Due to PHP being free and open-source, it is particularly popular in government agencies and universities.
Experts liken the vulnerabilities found in PHP to “a recall of a certain brick in a building due to a safety hazard,” implying that a significant amount of infrastructure will be affected, and owners must identify weak points themselves.
It is currently unclear if any websites have actually been hacked.
However, internet service providers report an increase in hacking attempts, along with worrying signs indicating that the vulnerability had been exploited even before the patch was released.
Matthew Prince, CEO of cybersecurity company Cloudflare, wrote on X platform, “Within 10 hours of the vulnerability being publicly disclosed, we monitored thousands of attempts to exploit the vulnerability across the entire network.”
“In the 45 minutes after the vulnerability disclosure, this number skyrocketed to tens of thousands; within two hours, it reached hundreds of thousands; and now it has reached millions.”
Junade Ali, a network security expert at the Institution of Engineering and Technology (IET) in the UK, stated, “These new security vulnerabilities are very serious, and there is evidence that they are being exploited. Several firewall vendors have deployed corresponding protective measures.”
Amazon also stated that the vulnerability is being “widely exploited” and reported that on October 17, four days before the vulnerability was publicly disclosed, the company had already experienced attacks targeting the vulnerability. Subsequently, detailed information about the vulnerability leaked on social media on Tuesday, leading to another attack on Amazon’s systems on October 21.
CJ Moses, Chief Information Security Officer of Amazon Web Services (AWS), wrote in a blog post that this attack appears to have been “launched by some threat actor (hacker), but it is currently unclear how this actor obtained actionable information before the vulnerability disclosure.”
Dr. Shaanan Cohney from the University of Melbourne said, “Even with just knowledge of the vulnerability (without specifics), attackers can easily pinpoint the location of the vulnerability using AI tools.”
“In the past, there was a considerable time gap between potential vulnerabilities being disclosed and specific vulnerabilities being discovered by security researchers or hackers, allowing relevant parties to responsibly release vulnerability advisories,” he said. “Now, artificial intelligence changes everything; this means a global rethink of how we handle vulnerability disclosure processes.”
If you operate your own website, make sure to install PHP patches, as this is crucial.
However, even regular Internet users need to remain vigilant in the coming weeks.
With a large number of affected websites, experts predict an increase in cybercrime and hacking activities, which could jeopardize your personal privacy information.
Jake Moore, a global cybersecurity consultant at ESET, told the Daily Mail, “For those operating websites, it is recommended to ensure that all sites with vulnerabilities have been repaired and to communicate with IT administrators to ensure system security.”
“For ordinary Internet users, this event should be seen as a warning: data on websites may be stolen in a very short time. Therefore, minimizing the provision of sensitive information to websites is crucial,” he said.
Moore recommends using multi-factor authentication services, passkeys, and digital payment services, and avoiding directly providing detailed bank card information to potentially compromised websites when shopping online.
He also suggests using a “guest account” for online shopping to “reduce the amount of information left on the website and prevent potential vulnerabilities in the future.”
Even if websites have applied patches, due to the deep-rooted PHP vulnerability in the Internet architecture, websites may still be at risk. Most websites integrate various software components, plugins, and third-party services, with operators having limited control over this content.
Professor Richard Buckland from the University of New South Wales told the Daily Mail, “In the coming days and even longer, do not trust all the content you see on various websites. Malicious attackers may tamper with text information on websites you trust.”
“Pay attention to government announcements. During this period, you can relatively confidently assume that mature institutions in terms of internet security like banks and telecommunication operators have updated their system patches. As for other websites, it is advisable to avoid visiting or logging in as much as possible in the coming days,” he said.
AI agents have helped discover these vulnerabilities. OpenAI stated in a blog post that over the past two months, they led an alliance consisting of researchers, security providers, and other institutions to collectively address vulnerabilities in PHP.
Wiz researchers also noted that they independently used AI to identify these vulnerabilities.
The proliferation of artificial intelligence means that organizations of all sizes now have more advanced methods to proactively and reactively deal with security threats. However, it also means that criminals have more advanced methods to exploit digital vulnerabilities on a large scale.