I try not to write too many doom-and-gloom cybersecurity stories, but this week's vulnerabilities involving PHP are too big to ignore.

With the help of AI, PHP flaws that had been lying dormant for years were dredged up and exploited, resulting in parts of the internet going dark as IT experts attempted to fix the problem.

Although your Windows PC isn't in the direct line of fire this time, the sheer speed and ability of AI when it comes to discovering (and exploiting) flaws shouldn't go unnoticed.

I've put together this guide to help you be proactive rather than reactive towards whatever security crisis comes next.

PHP is a programming language that's been around for more than three decades, and it quietly runs a large portion of the internet. Nearly 70% of websites with a known server language use PHP, including WordPress, Yahoo, Etsy, and Wikipedia. To say it's important is an understatement.

This week, two serious PHP security flaws known as "PHP2Shell" were made public. The exploits essentially allowed bad actors to take over servers and steal data. Once this news was public, countless bad actors began directing AI at the vulnerabilities.

The reaction? Some governments pulled their websites down to wait for a fix. IT teams worked countless hours to patch holes. Cloudflare fended off thousands of attempts to exploit the bugs, even before they were publicly announced.

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it.

Source link