If hackers exploited it, they could gain full control of servers, allowing them to copy or steal data or simply take websites offline. The world came close to a PHPocalypse on Tuesday (Oct 20) if it wasn’t for a volunteer software engineer in Czechia. Roughly 70 per cent of websites in the world use PHP, a programming language that runs behind the scenes on websites, handling tasks like loading pages and processing logins.
Earlier this week, cybersecurity researchers using a frontier model from OpenAI flagged two massive security vulnerabilities in PHP.
However, after the leak, it was decided that the patch would be released a day early on Wednesday, instead of Thursday. The PHP Foundation, which maintains the programming language, had recently learned of the flaws, but details regarding the fix leaked on a forum before a patch was ready. “Some stats on #php2shell.
Cloudflare CEO Matthew Prince detailed that the company saw thousands of exploit attempts in the 10 hours before the public announcement. That rose to tens of thousands within 45 minutes of it, and millions since. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now,” said Prince.
In a conversation with The Atlantic , Sury said the PHP Project brought him in before the public release of the patch.
He quickly packaged the patch for the vulnerabilities, allowing websites around the world to apply the fix. Ondrej Sury, who maintains PHP software packages in his spare time for the last 20 years, decided to take the initiative While the situation threatened to turn pear-shaped.
Sury downplayed his contribution, stating that it was simply his responsibility that he fulfilled While social media users praised him for single-handedly helping millions on the internet. A lot of the stuff that I do is automated. But the reason it was not crazy for me was that I actually don’t have any system running PHP myself. So for me, it was like, sure, I feel a responsibility toward the users of the internet. It would be a crazy day for me if I was on a boat in the middle of the Adriatic Sea. That could happen. Sury baked them into ready-to-install packages While the foundation provided the source code. If it wasn’t for him, website owners would have spent hours trying to figure it out, allowing the hackers to enter the door. “I’m in the stage of my life where I was like, This is bad. It needs to be fixed. But it doesn’t cause panic, at least for me. It did cause panic for a lot of people. But you know, it was more like, We have a situation, it needs to be solved, and this is how we do it. Following the security incident, donations increased significantly.
“I’ve been doing this for a long time, over 20 years. Apart from fixing the new versions, Sury back-engineered the fix for old versions of PHP going back 10 years, saving small businesses, schools and systems that would have been forgotten otherwise. Sury said contributions received over 24 hours were equivalent to roughly a year’s worth of donations previously collected.
But I had time to prepare the packages,” said Sury. Quizzed if he panicked when the people at PHP Foundation approached him with the severity of the situation, Sury said having time to prepare packages helped avoid any panic. And I have time to properly prepare,” said Sury. Sury said AI has sped up both attacks and defence, but the deeper problem is that infrastructure is taken for granted and underfunded. He said open-source work can feel like exploitation, and he wants the companies that benefit most to pay for it.
