The PHP scare may have faded from your feed, but the cleanup is far from over. Last week, two critical bugs in the open source language behind roughly 70% of websites left organizations scrambling to fix their systems, with some taking sites offline until the vulnerabilities could be patched. According to researchers who found the […]

The U.S. government cyber agency warns that hackers have figured out a way to exploit the popular PHP software, used in 70% of the web's software.

The moment you realize the internet is "held together by glue and dreams."

Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare.

A critical PHP vulnerability has triggered millions of exploit attempts worldwide. AI tools helped researchers uncover the flaw, leaving governments and companies racing to patch vulnerable websites.

Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being “broadly exploited” as governments and companies rush to secure their systems.

The world’s largest cloud computing provider on Wednesday said it had identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public.

Amazon added the flaws were “now being broadly exploited in the wild.”

Read full article

Comments

© Getty Images

Critical PHP flaws forced European government websites offline. Learn which PHP versions need patches and what IT teams should do.

The post EU Website Outages Follow Critical PHP Flaws: What IT Teams Should Know appeared first on TechRepublic.

This is the kind of security issue that was found and prevented by AI, but is also a high risk because of AI.

"PHP disclosed two critical vulnerabilities in their programming language and urged web site operators to immediately apply the fix," writes longtime Slashdot reader smooth wombat. "As a result, government web sites in Europe and elsewhere temporarily went dark on Wednesday as operators worked to protect their systems." The Independent reports: Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare, said that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure. "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update," he said on X. Officials have said that all PHP versions from PHP 5 onward could be affected, although PHP has not yet disclosed which versions are vulnerable. Special thanks to Slashdot readers Alain Williams and mrspoonsi for sharing this critical PHP security release. For more details, read the official PHP announcement and guidance on what to do next.

Read more of this story at Slashdot.

Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere.

PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.

Waiting for PHP2Shell

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the advisory stated. “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”

Read full article

Comments

© Getty Images