Science & Tech · Cybersecurity · 3 hrs ago
PHP vulnerabilities trigger urgent fixes as AI raises security concerns
Two cybersecurity firms rediscovered vulnerabilities in PHP, a programming language used by many websites.
The flaws could potentially let an attacker take control of a host server, but exploiting them was difficult.
The PHP Foundation knew about one bug in 2024, but developers had not agreed on a fix because each proposed solution had costs.
After the vulnerabilities were publicly announced, attacks increased sharply and fixes were pushed out.
Wikimedia and other sites took precautions, and PHP website operators were urged to upgrade.
The episode matters because the flaws could put servers and the information they hold at risk.
AI companies warn that more vulnerabilities may emerge, while also presenting their tools as a way to defend against them.
The companies expect a prolonged period of security challenges, but no specific next step is stated.
A vulnerability in PHP, a programming language used by roughly 70% of websites, prompted urgent fixes after it was publicly announced.
The flaws could potentially let attackers take control of a host server, although the threat had previously been considered theoretical.
Cybersecurity firms Calif and Wiz separately rediscovered the bugs.
The PHP Foundation had known about the bug since 2024 but had not agreed on a solution.
The article says generative AI is helping hackers and may lead to more vulnerabilities being found.
- Who
- PHP website operators were urged to upgrade; cybersecurity firms Calif and Wiz separately rediscovered the bugs.
- What
- Vulnerabilities in PHP prompted urgent fixes because they could potentially enable attackers to take control of a host server.
- When
- The PHP Foundation knew about the bug in 2024; the article says it was publicly announced in the weeks before publication.
- Where
- The vulnerabilities affect PHP applications and the host computers running them.
- Why
- The flaws could be exploited to gain remote control of a host server, and the article links rising concern to generative AI.
This story does not have two clearly opposing sides.
Developers at the PHP Foundation knew about the bug but could not agree on a solution.
The PHP vulnerabilities were publicly announced, and reports of attacks increased.
Fixes were pushed, and PHP website operators were urged to upgrade.
- PHP website share
- Roughly 70%
- Rediscovered by
- Calif and Wiz
- Known to PHP Foundation since
- 2024
- Potential impact
- Remote control of the host server
- Officially logged vulnerabilities since 1988
- Around 400,000
What people are saying
vulnerability tsunami