Decades-old PHP flaw triggers urgent patch warnings
TechCrunch reports a decades-old PHP vulnerability forced urgent patch-or-shut-down guidance, with millions of attempted exploits observed and AI expected to find more flaws.
What you need to know
TechCrunch reported that a decades-old vulnerability in the open-source PHP language triggered urgent guidance for website owners to patch immediately or take sites down. Cloudflare CEO Matthew Prince reported millions of attempted exploits, and Amazon observed attack attempts before public disclosure, according to the Equity podcast discussion.
- PHP underpins content management systems used by WordPress, Drupal and something like 70% of websites, per TechCrunch's Equity podcast.
- Website owners were told to patch immediately or shut down sites if they could not update right away.
- Cloudflare CEO Matthew Prince posted about the incident escalating to millions of attempted exploits.
- Amazon said it observed exploit attempts against the vulnerability before it was publicly announced.
- The specific flaws were found by human researchers, not AI models, though AI access is expected to make finding such vulnerabilities easier.
Patch or shut down
TechCrunch reported that a startling announcement went out earlier this week: due to recently discovered vulnerabilities in the open-source programming language PHP, website owners had to immediately patch their sites or, if they could not update right away, take the sites down to be safe.
On the Equity podcast, Sean O'Kane called it a real reckoning moment, while Kirsten Korosec noted that many people do not realize their websites run on PHP, the core ingredient behind content management systems used throughout WordPress, Drupal and something like 70% of websites.
Exploitation and disclosure
According to the podcast, Cloudflare CEO Matthew Prince posted that the incident had escalated to millions of attempted hacks. Korosec said Amazon, which operates a honeypot network, saw attempts to exploit the vulnerability before it had been publicly announced.
The discussion noted that the specific vulnerabilities were found by human researchers participating in OpenAI and Wiz's Hack the Planet initiative, though they used AI to exploit the bug. TechCrunch said widespread access to large language models and AI agents will make finding such flaws easier.
Open-source exposure
O'Kane said the incident shows the downside risk of building so much of the internet on open-source technology like PHP, describing the internet's foundations as held together with glue and dreams.
Korosec raised concerns about link rot as sites shut down rather than patch, and about banks, data and privacy. She also wondered whether new startups or open-source security tools will emerge in response.
What did Amazon observe about the PHP vulnerability?
According to TechCrunch's Equity podcast, Amazon operates a honeypot network and saw attempts to exploit the PHP vulnerability before it had been publicly announced.
Sources & context
Something needs correcting? Send a correction.
