PHP flaw: What cybersecurity pros say you should do now

OpenAI said researchers using its AI models uncovered two “critical” flaws in PHP, a popular open-source programming language used on about 70% of the world’s websites. Business Insider reports that the vulnerabilities primarily affect website owners and operators, but researchers say everyday users could still face risks if companies that store personal information have not updated their systems. The National Security Administration warned that hackers using one of the exploits could “steal sensitive data, disrupt services, or move deeper into a network.”

The concern is not that every individual runs PHP, but that many services people rely on may depend on PHP-based systems. Business Insider notes that digital commerce websites can store personal shopper information in PHP systems, which could become accessible to a bad actor if the provider has not updated. Madeline Lawrence, cofounder of Aikido Security, told Business Insider that people’s lives depend on companies that depend on those systems, and that some could be “deeply, deeply vulnerable.”

The clearest advice is to stop reusing passwords and use a password manager. Cybersecurity researchers also recommend turning on two-factor authentication for important accounts, especially email, banking, and password-manager accounts. Users should check for security advisories from their bank, expect more convincing scams or phishing emails if their data has been breached, and keep auto-updates on while restarting their computer weekly.

For people who own or operate websites, Business Insider reports that PHP has released updates intended to help shield sites from hackers. The article says instructions for applying those updates are available on PHP’s homepage. The immediate takeaway is simple: patch quickly, because the report says Cloudflare saw millions of attempts to exploit the vulnerability one day after disclosure.