The whole internet world was exposed to the news that appeared last night PHP security It is awash with deficits. WordPress Security vulnerabilities that allow malicious code to be written without logging in in PHP, the programming language used on more than half of the internet, such as websites, were discovered with the help of artificial intelligence. The US National Security Agency (NSA) advised organizations that could not update their sites to close them.
SECURITY VULNERABILITIES ON A GLOBAL SCALE
Security vulnerabilities discovered in the PHP programming language, which runs the vast majority of websites, caused alarm around the world. Some government sites were temporarily taken offline due to newly detected security vulnerabilities on a global scale.
The US National Security Agency (NSA) issued a rare public warning about vulnerabilities in PHP on Wednesday, recommending that sites that cannot be updated promptly be taken offline.
In its social media post, NSA said, “Effective immediately, all organizations using PHP in their systems are advised to be prepared for an update that addresses two critical vulnerabilities.”
GOVERNMENT SITES ARE OFFLINE IN EUROPE
In Germany, the Federal Ministry of Digital Transformation and State Modernization announced that it was taking some sites offline as a preventive measure. The French Ministry of Internal Affairs disabled the official sites of local administrative offices. Authorities in Belgium, the Netherlands, Finland and the Czech Republic also announced that they closed the sites to apply a security patch to close the PHP vulnerability. Japanese Prime Minister Sanae Takaiçi warned about the PHP risk on social media.
WHY DOES THE SECURITY Vulnerability pose such a major threat?
The vulnerability was discovered as a result of investigations carried out by researchers at Wiz and Calif using advanced artificial intelligence tools. Researchers stated that it has not been noticed by anyone in the PHP infrastructure for more than ten years. The biggest threat posed by the vulnerability in question is that it allows attackers to directly take control of vulnerable web servers without the need for any authentication.
It is stated that attackers can use this vulnerability to leak sensitive data, gain direct access to databases and even gain full authority over systems. Moreover, experts warn that attackers can develop attack codes that exploit this vulnerability much faster by using artificial intelligence tools.
WHAT IS PHP?
PHP is an open source programming language that runs on the server side and dynamically compiles the content of web pages and sends them to the user’s browser. It’s free, open source and maintained by volunteers. Additionally, site owners rarely interact directly, which makes it very popular.
There is a market share of nearly 70% among programming languages that can be identified in the internet world. So around 70% of the internet uses PHP. We also see PHP in most popular systems, especially WordPress, which is used on millions of sites and powers approximately 40% of all websites, such as online stores and news sites. It’s available on numerous sites, including Wikipedia. Therefore, a single vulnerability in the PHP core has the potential to directly target millions of servers around the world.
