The PHP programming language crisis we are facing did not happen suddenly. The most important lesson we can learn from what’s happening is that the infrastructure that supports both the Internet and many of the services we use regularly is fragile. Many of its weaknesses remain Hidden for yearsBut the advent of sophisticated artificial intelligence (AI) models is bringing them to light.
If we stick to the problem that triggers PHP, OpenAI, Google and other AI laboratories are using their most advanced models to identify vulnerabilities in this language, develop exploit tests and validate the fixes that engineers propose. It’s clear that AI is a very powerful tool when it comes to finding bugs and fixing them, but what’s happening brings something to the table that became very relevant when the Anthropic Mythos preview launched in early April.
The operating systems, browsers and software used by the servers on which the Internet is built have many vulnerabilities. Some of them, such as those affecting PHP, are structural in nature, so it’s important to identify and fix them before malicious actors can exploit them. AI is a defense shield against this problem, but it can also be used by bad actors to launch attacks because it has the ability to greatly reduce the time and knowledge required to convert a known vulnerability into a successful attack.
The PHP crisis is one of the most serious we can face
Government and private organizations that yesterday decided to dismantle parts of their infrastructure to avoid greater damage had good reason to do so. PHP is a programming language that runs on the server and allows you to create dynamic pages. The scope of a vulnerability in a specific web page is limited, but a vulnerability in the core of a widely used programming language like PHP can affect numerous applications. Even if they are impeccably programmed.
The vulnerabilities that triggered this crisis could be used to execute code remotely without requiring authentication
This is the structural relevance of PHP that I talked about a few lines above. A revealing fact: this programming language is present in about 70% of websites, but it has a very wide spread This is not the only problem which we face. And the vulnerabilities that triggered this crisis could be used to execute code remotely without requiring authentication.
This scenario could allow an attacker to compromise the operation of a server running an application. To understand how serious this situation can be, we only have to imagine that it could be a server in a bank, appointment management in a hospital or the administration of unemployment benefits. Depending on the infrastructure that is affected, this can range from exposing sensitive information to disrupting essential services.
There is an important nuance that should not be overlooked: we must distinguish between websites that use PHP, which run vulnerable versions in configurations susceptible to attack, and those that have suffered successful intrusions. Promotion of this programming language on websites (that 70% I mentioned a few lines above) helps us size correctly The extent of the problem, however, does not reveal how many websites have been compromised. We will likely find out this information in the coming weeks.
Picture | Mikhail Fesenko
In Xataka | China has plans to win the AI war against the US. And Dipsik’s champion
