PHP Hacking Vulnerability Sparks Global IT Crisis

Kathmandu. Following the discovery of a serious cybersecurity vulnerability in PHP, a programming language used by millions of websites, IT and cybersecurity experts worldwide have been pressured to fix it.

According to the BBC, IT professionals have been busy over the past 48 hours securing websites, updating software, and preventing potential cyberattacks. Experts say that misinformation and unnecessary panic have further complicated the issue.

Microsoft CEO Satya Nadella said he had not seen a situation like the PHP security crisis in a long time, noting that IT and security teams worldwide have had to work day and night.

According to British system administrator Adam Mudge, the number of messages received from website operators expressing concern and asking questions has increased unusually. He said some clients are urging them to shut down websites as a precaution, while on the other hand, there is a challenge to implement security updates across various systems.

“Sometimes it takes longer to shut down a website than to fix a PHP problem,” Mudge said. He added that he has been working from early morning until 10:30 at night to secure clients' systems and has not been able to get enough sleep.

PHP is a popular programming language used to operate millions of websites. Following the discovery of two serious security vulnerabilities in it, cybersecurity agencies in various countries urged immediate security updates or the shutdown of websites and servers.

According to Mauritian IT administrator Loganaden Velvindreon, the technical support period for some versions of PHP has expired, making it more difficult to implement security improvements in those systems. He said that in some cases, web applications have had to be rebuilt and code changed.

John Jones, technical director of a digital advertising company, said that as soon as the warning about the security vulnerability was made public, they immediately started working. He said there was a competition to implement the new version for PHP security improvements, which was released at 3 p.m. on Wednesday.

However, he also expressed concern about the risk of other technical problems arising from software updates.

Meanwhile, further confusion arose after details of the PHP security vulnerability were leaked ahead of schedule, and rumors spread that cybercriminals had already started using it to launch attacks.

According to British cybersecurity expert Daniel Card, many pieces of misinformation were spread, claiming that hackers had already figured out the attack method. He said that while the security vulnerability is serious, there is not enough evidence to support the rumors that cybercriminals are effectively exploiting it.

Although security companies Cloudflare and Amazon Web Services (AWS) warned of millions of hacking attempts per hour, the BBC reported that no evidence of widespread data theft or cyberattacks has been found.

Experts say that although efforts are being made to develop new hacking methods using artificial intelligence (AI), these efforts have not been widely effective so far. However, they have warned that the situation could change in the coming days.

Similarly, it is said that AI has also been used to identify PHP security vulnerabilities that human researchers could not detect for decades. Experts estimate that as the capabilities of AI tools increase, more serious security vulnerabilities like these may be publicly disclosed.

Mark Maunder, founder of WordPress security tool Wordfence, said that while the discovery of serious security vulnerabilities by AI will increase, the way information is communicated about them needs to be improved.

He pointed out the risk that users and security teams may become desensitized to warnings due to frequent alerts and unconfirmed information. This situation is called 'alert fatigue'. Experts say that a balance in information dissemination is necessary, as people may ignore warnings in the future even when real and extremely serious security risks arise.