Major Flaw Disrupts Websites Worldwide

On October 21^st the tech world woke to news of a serious flaw in a type of scripting language called PHP. You may have never heard of PHP, but you certainly have interacted with it. PHP has been around since 1995 and an estimated 60-70% of the world’s websites now run some form of PHP. A pair of vulnerabilities were discovered by an AI model that could let an attacker run unauthenticated remote code execution on a web server. These flaws were rated 9.2 out of 10 on the CVSS severity score. Over the following hours and days, website managers raced to apply the patch before an exploit could be developed. This meant that many websites were brought offline to be patched, or to mitigate against an attack as older versions of PHP couldn’t be quickly secured. It’s now reported that an exploit has been observed in the wild and unpatched websites may already be compromised. To their credit, the PHP developers have been very open about the vulnerability and provided a patch (multiple patches, actually) in record time. But this widespread reliance on a common platform highlights the fragility of the technologies we depend upon daily. There’s no simple solution to this larger problem, but I pour one out for those nameless coders who have had to slog through some long hours to keep our systems patched and running.