// THE VERGE — INTELLIGENZA ARTIFICIALE
PHP: The three little letters wreaking havoc across the web
Two vulnerabilities found in the programming language PHP put enormous swaths of the internet in danger.
By some accounts, up to 70 percent of websites use PHP in some capacity. It powers Wikipedia, WordPress, Drupal, and a host of other popular sites and platforms, including DeviantArt and 4Chan, which were temporarily shut down after the vulnerabilities were disclosed. Even governments weren’t immune.
But it’s not as simple as updating a few servers. The vulnerability exists in every version of PHP dating back roughly 20 years, many of which are no longer supported. That means some older sites and services that are no longer actively maintained are at risk, leaving them with little option but to permanently shut down.
Here’s all the latest developments in what security firm Wiz has called “among the most severe vulnerabilities discovered … in software history.”
The list of sites that had to go down, at least temporarily, because of the recently disclosed PHP vulnerability keeps growing. Thankfully, the Internet Archive’s ops team quickly got things patched, secured, and back online. Digital librarian Brewster Kahle posted his thanks on Mastodon last night: “Given the severity, there are heroes in many many orgs from last night. Could have been no lights, no traffic signals, real problems.“
World Quest and Save My Demonic World have run for over a decade, but they’re built on older tech that the developers say can’t be updated to patch the apocalyptic PHP exploit disclosed this week. Because the vulnerability affects almost 20 years of PHP, big chunks of internet history are in danger of being lost. Per Kotaku:
Many old websites and services that are no longer being actively updated (or may simply be too old to receive the update, as was the case for these two games) are now at risk of permanently going offline. Such an event would lock swathes of the old internet from public view, including bits that were already beginning to break down and become inaccessible.
CEO Matthew Prince says the company saw thousands of attempts to exploit the PHP vulnerability across the Cloudflare network in the 10 hours before the issue was publicly announced. That jumped to “hundreds of thousands” of attacks in the 2 hours after the disclosure, and “millions” by last night. Yikes.
Two bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia, and the blog where the bar around the corner posts pictures of people’s dogs. The “critical vulnerabilities” were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress. But it’s far bigger than that. Some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X recommended that organizations take their systems offline if “an immediate update is not feasible,” as did the UK’s National Cyber Security Center. Even Pokémon Home and Pokémon Champions were taken offline, Kotaku reports.
The vulnerability isn’t exactly new. It’s been present in PHP for roughly 20 years, but exploiting it “required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” according to security firm Wiz. However, powerful AI models have made it much easier to turn that kind of obscure bug into dangerous vulnerabilities.