Websites and services ranging from 4Chan to Spotify are all at risk

Don't be surprised if your favorite website is completely down on Wednesday. A massive security risk has just been discovered, and it impacts nearly every popular website on the internet. That includes websites like Wikipedia, Slack, Spotify, and even Pornhub just to name a few. WordPress at large is at risk, and that platform is estimated to power nearly a fourth of the internet.

Though a fix is on the way, the vulnerability will be live for an entire day.

The internet may not be a series of tubes, but much of it is built on a back-end technology called PHP. This is an oversimplification, but PHP is the reason a server can retrieve pieces of information needed to build and serve web pages. PHP is how, for example, a website built on static HTML can nonetheless change dynamically based on the user's input — the technology handles the site's logic and delivery.

If that doesn't quite make sense, what you ultimately need to know here is that a staggering proportion of the internet uses PHP.

Here's the problem: an unknown entity recently leaked the existence of two PHP vulnerabilities that could, in theory, allow bad actors to perform remote code execution without authentication or security credentials. This means hackers could erase information at will, or use websites to inject scripts that attack their targets. A hacker could use the PHP vulnerability to lock a system until a ransom is paid.

Source link