1. The security flaws in PHP that have put governments and companies around the world on alert

Released in 1995 by developer Rasmus Lerdorf, PHP (initially Personal Home Page and now Preprocessor Hypertext) is an open source programming language designed for creating dynamic pages.

That is, unlike static websites that always send their users to the same page as if it were a book, the site generates its content depending on the user, consulting a database and checking if the user is logged in, to be able to show personalized information or content in real time.

This versatility has made it enormously popular, to the point that around 7 out of 10 web pages use it, with sites like Wikipedia or WordPress as an example, which means that any vulnerability impacts a large number of users.

Currently PHP is maintained by a non-profit organization called the PHP Foundation, created with the mission of supporting, financing and guaranteeing the long-term development and maintenance of the programming language.

Using artificial intelligence, researchers from the cybersecurity company Calif and the company OpenAI independently identified two vulnerabilities in PHP in August, which they have named “php2shell.” The vulnerabilities are inherent to the PHP language itself and affect versions released in the last decade.

“The problem was related to a component that managed the progress of file uploads,” he points out to The Commerce Sergio Azahuanche Gutiérrez, senior cybersecurity consultant for Marsh Perú. “An unexpected interruption in its operation could allow the attacker to inject third-party code and gain greater privileges.”

“As PHP works under a request system, when a request runs out of resources in the middle of processing, PHP leaves data halfway without completing its authentication, then false data can be processed as true,” adds Luz Antuanet Adanaqué, professor in the Department of Computer and Data Science at UTEC.

Metaphorically, it was like having the door of your house open to anyone who knew the trick of your lock, and in the case of PHP an attacker could take advantage of the vulnerability to gain access to the resources of a page, including sensitive user information.

“Vulnerability received a score of 9.2 out of 10 on the CVSS scale, used internationally to evaluate the severity of these problems,” says Azahuanche Gutiérrez. “It is a critical qualification, especially since exploitation attempts were already being recorded.”

By comparison, Heartbleed, the OpenSSL vulnerability that caused panic a decade ago, only had a score of 7.5.

On Wednesday, the PHP Foundation released a patch to close the vulnerabilities in its code, urging all its PHP users to update them immediately.

“That is one of the recurring problems in cybersecurity. When a vulnerability is discovered and there is still no correction available, a window opens during which attackers can take advantage of it,” highlights Azahuanche Gutiérrez.

The announcement of the vulnerability generated alarm globally, and governments of countries such as the United States, Japan, Germany, Singapore, Australia and the Netherlands issued warning statements and even left their pages offline until the patch could be applied.

“The PHP community published fixes for different versions, including some older ones that were already out of support. While there is no patch, providers like Cloudflare can help identify and block exploitation attempts through web application protection mechanisms,” he adds. “However, those measures are not necessarily a substitute for correcting the software.”

This vulnerability also touches on a serious cybersecurity problem, which is technological obsolescence, where some organizations cannot update their programs, in this case their version of PHP, because their programs depend on very old hardware, which leads to already known vulnerabilities being left open that have been patched by later versions.

“Companies must schedule progressive hardware migrations, so that renewing their systems does not become an overly expensive and complex process when it is already inevitable,” emphasizes the expert. It is understood that in many cases, the price of a cyber attack can be much more expensive than replacing electronic components.

What action you should take depends on whether it is a person using a website or someone who manages and develops a platform.

If you fall into the first category, you mainly depend on the platform and its responsible company to correct the vulnerability, so there is not much you can do there. However, you can still take measures to protect yourself, such as keeping all your devices updated to the latest version and, if you suspect that your data has been compromised, it is imperative that you change any passwords that are at risk.

For companies and those responsible for websites, the measures are more specific, and consist of installing the available security patches and, as long as there is no correction, applying temporary measures such as disabling the vulnerable component, isolating the affected systems or reinforcing their monitoring.

PHP has demonstrated once again how the advent of artificial intelligence has changed what was known about cybersecurity, with Calif researchers using this technology to find this flaw and cybercriminals taking advantage of it to try to commit their crimes in a much faster way than humans could.

“AI is capable of flooding a website with requests very quickly, among other things,” says Luz Antuanet Adanaqué. “The vulnerabilities were there before, what AI is doing is evidencing them in record time, most likely they will continue to appear.”

It is a new reality that will cause this type of incidents to be repeated more frequently in the near future, agreed the cybersecurity experts consulted.

“It is a race between the teams that attack and those that defend, but now accelerated by artificial intelligence,” agrees Azahuanche Gutiérrez.