Tech Breaking
The vulnerabilities were discovered by cyber-security researchers at the firms Calif and Wiz. Calif, along with PHP Foundation, were part of an initiative started by OpenAI called Patch the Planet. As part of this, researchers were given access to advanced AI tools to help identify and analyse vulnerabilities in PHP.
OpenAI said in a blog post that the discovery was "one of the most impactful security issues in recent memory". It added that an internal researcher at the company had also discovered the issue at around the same time as the other firms. The flaws had gone undetected for more than a decade but by August, after a few weeks of using advanced AI tools, they were discovered.
Wiz estimated "roughly 70%" of websites are affected, though the BBC is unable to verify that figure. The PHP Foundation had planned to announce the vulnerability later this month alongside a software patch. However, details of the flaw were leaked on social media on Tuesday.
The leak prompted the PHP Foundation to disclose the flaw and issue a fix earlier than planned. The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia have urged those who use PHP to apply the fixes. "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC said in a note.
Source: BBC
