Crucial vulnerabilities in a programming language that underpins much of the internet are so severe that U.S., European and British authorities have recommended websites temporarily go offline until they can be fixed.The flaws are in PHP, a little-known but crucial programming language which powers how web servers process code. The security team that maintains PHP released patches to fix the problem around 10 a.m. ET.But several websites were temporarily down as of Wednesday morning, citing fear that hackers could take them over. They included Pinboard, a bookmarking site and some parts of Wikipedia. Two massive but largely unmoderated forum sites, 4Chan and Something Awful, both went offline to wait for a patch.Japanese websites were also voluntarily offline, including systems for daycare centers and video games, the Japanese tech news site ITmedia reported.PHP is used in 69% of all websites, according to W3Techs, which surveys the software behind how the internet works. As of Wednesday, nearly 55 million web properties were running PHP, according to Censys, a company that specializes in scanning internet infrastructure.But just how many of these properties had applied the update was unclear.It could be days before it’s clear how many sites were hacked before they were able to patch their vulnerabilities, said Silas Cutler, a principal security researcher at Censys.“Right now, folks are boiling the ocean trying to figure out the how to move from ‘All PHP is vulnerable,’” he told NBC News. “In a few days, there should a better scoping.”OpenAI said that it helped discover the vulnerability and brought it to PHP’s attention before hackers exploited it more severely.“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” the company wrote in a blog post Wednesday.“It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.” The vulnerability was discovered through OpenAI’s program to give cybersecurity companies access to ChatGPT models that are adept at finding software flaws, the company said. As websites around the world patched the flaws Wednesday, it was unclear how severely hackers were already exploiting it. Patchstack, a cybersecurity platform, said it had received “reports of active exploitation.” The chief technical officer of Cloudflare, one of the internet’s largest website hosting companies, wrote on X, “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”Further complicating the effort to release PHP patches Wednesday was a remarkable breach of protocol allegedly committed by Chainguard, a company that develops open-source software designed to reduce cybersecurity vulnerabilities.According to the PHP Foundation, which works to develop and maintain PHP code, Chainguard shared the details of the patch six hours ahead of its release, breaking an embargo agreement with PHP. By posting the details of the patch ahead of its release, PHP said Chainguard made it easier for hackers who saw the post to reverse engineer the PHP fix in order to keep hacking the vulnerable software.Chainguard did not immediately reply to an email requesting comment.Government agencies around the world, including the U.S. National Security Agency, have warned of the flaws and recommended potentially taking sites offline until they’re fixed.CERT-EU, the European Union’s technical cybersecurity advisory body, said, “Organisations should consider isolating internet-facing applications from public networks until a fix is available.”The United Kingdom’s National Cyber Security Centre recommended, “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”The primary U.S. cybersecurity agency, the Cybersecurity and Infrastructure Security Agency, said in an advisory late Wednesday morning that it recommended patching the software flaws, but that it had “not observed exploitation of these vulnerabilities as of the time of publication.”
——————————————————-
Click Here For The Original Source.
