Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb
I once worked opposite a site where a shopping centre was being built.
The PHP story feels like the cyber equivalent of an unexploded bomb - I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet.
Cyber security authorities are warning website owners to fix the weaknesses immediately, but the patch only works on the latest version of PHP, so older sites will need to upgrade first.
The weaknesses found in the PHP programming language, which is used by millions of websites, had been quietly resting there for years and are not easy to exploit.
We were warned there might be unexploded bombs from World War Two unearthed during the construction.
I once worked opposite a site where a shopping centre was being built.
As I write this, there are no reports that anyone or anything has succeeded in using the flaws to attack a site.
We probably won't know for a while whether it has worked for any criminals, because the companies affected might not be aware yet either.
But the baddies can use AI too, and those same tools are probably churning away right now trying to get in.
The tech is getting a lot of credit here for assisting researchers in finding the bugs, and the PHP foundation, which oversees the programming language, was on the case and issued a fix.
It was supposed to be kept quiet until everyone had a chance to fix their sites - but the news was leaked.
What happened
The PHP story feels like the cyber equivalent of an unexploded bomb - I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet.
Cyber security authorities are warning website owners to fix the weaknesses immediately, but the patch only works on the latest version of PHP, so older sites will need to upgrade first.
What changed
The weaknesses found in the PHP programming language, which is used by millions of websites, had been quietly resting there for years and are not easy to exploit.
We were warned there might be unexploded bombs from World War Two unearthed during the construction.
Who is affected
I once worked opposite a site where a shopping centre was being built.
As I write this, there are no reports that anyone or anything has succeeded in using the flaws to attack a site.
Why it matters
We probably won't know for a while whether it has worked for any criminals, because the companies affected might not be aware yet either.
But the baddies can use AI too, and those same tools are probably churning away right now trying to get in.
Response
The tech is getting a lot of credit here for assisting researchers in finding the bugs, and the PHP foundation, which oversees the programming language, was on the case and issued a fix.
It was supposed to be kept quiet until everyone had a chance to fix their sites - but the news was leaked.
Attribution
BBC News: I once worked opposite a site where a shopping centre was being built.
What to watch next
Watch for updated vendor guidance and fixed-version details.