PHP, one of the most widely used programming languages for hosting websites on servers, is at the centre of a global cybersecurity crisis. Researchers at cybersecurity firms Qualys and Wiz recently used artificial intelligence to identify two critical security flaws in the language. Although PHP authorities released patched versions, hackers are already exploiting the vulnerabilities to attack websites around the world. In response, governments and security agencies in the United States, Germany, France, the Netherlands, Japan and other countries have issued unprecedented warnings and temporarily taken their own websites offline.

PHP is primarily used on servers that host websites. Andrew Cullen, a lecturer on artificial intelligence and cybersecurity at the University of Melbourne, said countless machines worldwide depend on a single fundamental piece of software, and it is exactly there that the bug was found. Exploiting the flaw, a hacker can run their own code on a website, alter the site, or force the disclosure of personal data stored in its database.

Bangladeshi software engineer and technology entrepreneur Sumit Saha said the weaknesses stem from PHP's memory management, particularly in how it handles severe errors such as memory exhaustion. This could expose a server's internal memory data or allow malicious code to be executed.

Cloud security firm Wiz said the problem lies within PHP itself, which means even ordinary websites running any version of PHP could be at risk. Through these flaws, cybercriminals can siphon passwords and other sensitive information from server memory. The vulnerabilities are believed to have remained hidden in PHP's codebase for more than a decade.

Behind this cyber threat are long-standing weaknesses buried deep in PHP's coding structure, mainly in how the language handles excessive memory use or fatal errors. Present in versions released over more than a decade, from PHP 5.4 onwards, the flaw went unnoticed until now. Through it, an attacker can remotely run malicious code or commands on older PHP-based servers over the internet, without any password or valid account access. Hackers can easily steal users' personal data from a website's database or server memory, modify information, or take complete control of the site. While artificial intelligence is helping identify flaws faster, hackers are equally misusing it to open new avenues of attack.

Amazon's chief security officer, CJ Moses, said that on 20 October, four days before news of the PHP flaws became public, Amazon's security team detected an attempted cyberattack exploiting them. It remains unclear how hackers learned of the vulnerabilities while the Qualys and Wiz reports were still under embargo. Security researchers typically keep flaw details secret until a fix is ready so that attackers cannot take advantage of them. The flaws, dubbed PHP2Shell, have been rated 9.2 out of 10 on the severity scale and are described as highly sensitive. Blogs, e-commerce platforms and government portals of various countries are built on PHP, and roughly 70 per cent of websites worldwide use the language. That does not mean all of them have been hacked; the level of risk and the likelihood of attack vary depending on the affected version and server environment.

PHP, a programming language dating back to the early 1990s, now powers a vast portion of the internet, particularly sites built with WordPress, Drupal and Joomla. Any critical flaw in PHP can therefore have far-reaching consequences. Qualys, Wiz and web infrastructure provider Cloudflare said the vulnerabilities affect PHP 5.4 and all subsequent versions, leaving most of the world's websites exposed to security risk.

The threat carries significant weight for Bangladesh as well. According to Sumit Saha, PHP is a widely used server-side programming language. Though PHP itself is a highly modern and secure language, websites become vulnerable to hacking when they run outdated versions or face server-related complications. Many Bangladeshi websites are built with PHP, yet updated code and patches are often not applied in time, multiplying the risk of cyberattack. The main way to stay safe is to update the relevant software and code immediately. The flaws were fixed in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released on 21 October.

The PHP Foundation, the US national security agency and other world-class technology organisations have warned that website administrators must install security patches or fixes immediately to avoid any major disaster. Regular security updates, proper server configuration, access control and security monitoring can significantly reduce the risk of such cyberattacks.

Source: Al Jazeera