r/news • u/Klutzy-Ad4172 • 6h ago
Urgent security fix issued for code vital to estimated 70% of all websites
https://abcnews.com/Technology/urgent-security-fix-issued-code-vital-estimated-70/story?id=137447718211
u/newleafkratom 5h ago
..."The PHP team said updating the code is the only complete fix. While it lists temporary measures to address the vulnerabilities, such as adjusting memory and upload settings, it notes that those measures only reduce exposure and do not make a server safe from potential exploitation...."
175
u/Klutzy-Ad4172 6h ago edited 6h ago
Vulnerability is now available to hackers. Here is a better link https://decrypt.co/381519/php-panic-critical-bugs-70-percent-internet-risk-everyone-freaking-out
81
u/Fractoos 6h ago
Not just that, you can weaponize it in about 5 minutes with AI to wreck havoc.
40
u/touchet29 4h ago
Where's Mythos, where's Fable? Where's Opus?
Who will win? Hackers with their tiny local open-weights? Or The American AI Tech Gods?.
Let's see the true worth of that $2T valuation.
11
24
u/oviforconnsmythe 4h ago
Would telecoms companies rely on PHP to maintain their services? Orange mobile in France lost mobile connectivity nation wide today and it was down for like 8h, I'm wondering if this was related.
11
u/echoedatlas 1h ago
Yes, it is likely. PHP is still widely used for websites and other scripting requirements.
14
u/olearyboy 4h ago
I for one welcome a good old fashioned overflow heap execution, I’m sick to death of these f-ing supply chain attacks
3
277
u/fxkatt 5h ago
"Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact."
And can as easily cause such flaws.
180
u/tombob51 5h ago
Weird comment on an incident where AI found a bug in human-written code but ok
121
u/Octavus 4h ago
A bug present in open source code that anyone can view for more than two decades that no human found.
10
u/lekker-boterham 1h ago
That’s actually not true. A security engineer identified this vulnerability years ago, but it wasn’t addressed at the time due to the complexity of code required to fix it and the seemingly low likelihood that it would be exploited.
•
47
u/Shawnj2 4h ago
This is much more about AI being able to have the resources to do this than about humans being terrible code reviewers or AI being a savant or something. You can get an AI agent to go over every single open source package with a fine tooth comb for vulnerabilities for a lot cheaper than paying a team of software developers to, and most teams weren’t doing the latter because it’s way too resource intensive to do so
6
u/Mechakoopa 1h ago
The thing is this particular flaw was known about "in theory" for a long time, but it was going to be difficult to patch and even more difficult to successfully exploit, as in nobody had actually managed to figure out how to get everything to line up the right way to go wrong in a controlled exploitable manner until recently. They weren't even sure it WAS possible, just theoretically possible.
8
u/calinet6 3h ago
Yes. LLMs are large scale pattern matchers. Of course they are good at tasks like this. It’s a kind of intelligence, but it doesn’t mean humans are stupid in comparison.
Computers can also calculate primes a lot faster than I can, doesn’t mean I’m not intelligent.
•
u/jonathaz 47m ago
Or they did and can exploit it, but kept it under wraps so they can keep hacking your aunt’s Wordpress site.
5
u/horangiwhakkatchi 1h ago edited 1h ago
A bug that would not have been easily exploitable by humans even if they were aware of it. AI both found the bug and provides the means to exploit it easily and at scale.
It was not a 'oh duh! What a dumbass coding mistake'. It is a rare intersection between many undesirable things happening at once in order to achieve the unauthenticated RCE.
This will keep happening as hackers and cybersecurity researchers use AI to plumb the depths of the codebases across the internet. Lucky it was found by a cybersecurity team first this time.
10
u/TheVenetianMask 4h ago
Humans found the bugs, one of them two years ago, and OpenAI coincidentally found one of the two bugs the same day as a researcher.
14
55
u/iDidntReadOP 5h ago
I don't understand comments like this. Human code has errors, flaws, and bugs. Why is that empirically better than AI doing it? It's still the human signing off on the code and sending it to production.
34
u/noodle-face 4h ago
People have no idea how software engineering actually works, that's why
0
u/fatbunyip 2h ago
Honestly, when you see how few people understand that more commits = better software that you realise how stupid people are.
58
u/voldin91 5h ago
Why is that empirically better than AI doing it?
With the latest models it's honestly not. Humans should still be reviewing whatever gets pushed out to production, but anyone who still says that AI only puts out slop code (worse than most humans) is either basing it off old models or trying to cope
15
u/hotkarlmarxbros 4h ago
The biggest thing that “human code” has going for it is the reduced velocity. It doesnt matter that ai code has half the bugs (generous). When you are churning out at 10x the velocity, that is a lot more surface a lot faster for issues, security or otherwise, to come up.
I’m no luddite, ai coding is where the future (present?) is going, but we are still in the early stages. It is like the early days of computing when everything was heavily optimized for performance, and down the road we realized what sort of tremendous security issues come with a lot of our practices like directly reading from or writing to any memory address. We are going to be playing catch up with a lot of security practices and regulations as we make these giant leaps in our output.
9
u/Slypenslyde 4h ago edited 4h ago
AI can create flaws humans won't catch. This is no change. If a human didn't understand the flaw in the first place that human won't catch an agent that made an error based on some other human error it ingested.
AI can find flaws much faster than humans. This is a scary new reality. Not every agent searching for flaws is a researcher hoping to patch them. The majority of them are attackers. It's not a great table at the casino.
Statements like the quoted text are trying to spin this as an improvement "because AI can find flaws so quickly". But the REAL improvement would be if AI can demonstrably write software without flaws even if the operator doesn't understand security. The reality is shit is a lot worse than it was and there's no realistic solution.
Yes, I can analyze my own software and likely find/patch flaws. But I'm still 1 person running 1 agent with 1 subscription and there are going to be 1,000 people running 1,000 agents trying to break what I make. The game's in turbo mode, but the odds have not changed.
6
u/randombsname1 5h ago
The more AI advances the more this is less likely. Actually its far less likely even now.
As long as you aren't vibe coding shit and accepting literally everything.
Any junior level programmer wouldn't even do this level of shit with AI at this point.
A fancy box of vectors (AI) is especially good at spotting subtle bugs that have/would go on for fuck knows how long.
9
u/Sombre_Ombre 5h ago
Anthropic released a doc about how work is changing, they made a metric, how many hours would it take to read all of Claude’s output per week, per role, per person?
It would take an engineer at Anthropic 424 hours weekly to read all the code Claude produces on their behalf. They were bragging.
-4
u/PowderPills 5h ago
Was just thinking this same exact thing. It’s only a matter of time until we find out it’s already happening.
26
u/AbdussamiT 5h ago
Even if they fix the issue, you’ll have to jump to that version. How many people/ teams are going to do that?
76
u/yohanleafheart 5h ago
Any serious team is already doing that/has already done that
32
u/xSlippyFistx 4h ago
Exactly. People have jobs specifically for this exact purpose. Monitoring vulnerabilities and updating vulnerable dependencies for their apps/sites. It’s like cyber security 101
7
u/TooPrettyForBoymode 4h ago
Yet many companies are not anywhere close to the newest version because they don’t want spend the time and money to rework their code for deprecated functions.
8
u/_PurpleAlien_ 4h ago
If you're on Debian (and others), you're fine. They already back-ported the security patches to older versions. Just run a normal system upgrade. It'll bring your current PHP version up to a patched state without changing major/minor versions or breaking any of your config.
9
u/sorean_4 4h ago
There are no fixes yet for embedded web components. For example PalAlto firewalls, all are affected without a fix. This has repercussions across large number of software and hardware stacks.
2
u/yohanleafheart 4h ago
Wait what? For Palo alto? I long time ago I worked with their firewalls and I rmeebe being possible to upgrade the OS. Why wouldn't it be possible now?
5
•
u/Kismet-IT 17m ago
I work for a global multi billion dollar company, who specializes in advising other companies. I think our team is serious enough in regards to knowing what is needed but our CIO is not. They won't staff us properly to do what is needed. So we don't even have a team that does it. We have people in the roles but just two of them isn't enough. Especially when they then need to notify the other teams who are impacted and need to actually do the patching, and those teams aren't staffed to handle it. I'm not putting in extra hours for this one, it's not my circus.
11
u/gokogt386 4h ago
Considering how many websites I regularly use went down at the same time? Probably a lot
4
u/lowbatteries 4h ago
Yes, if you care about security, you have to be on a version that gets security patches. Just like any software.
2
u/1touchable 3h ago
Small, outdated website will have a biggest problem. They don't have a proper teams mostly and are running on older versions, which is trickier to update since not all the deoendencies will have support for new one, and if they have, they might have other changes introduced which will require a lot of work to adjustband retest everything.
•
u/Chrisaarajo 39m ago
Our IT was actively watching it and had killed the impacted functionality pretty much immediately. We received multiple emails from vendors we use to let us know they’d killed the impacted features on their platforms as well.
Anyone doing more than the absolute minimum was working on minimizing risk and waiting for a fix.
52
u/7573657231 5h ago
That number is not accurate.
The article cites https://w3techs.com/technologies/details/pl-php for the statistic which has the veribiage "PHP is used by 69.3% of all the websites whose server-side programming language we know."
And according to https://w3techs.com/technologies, the number of websites in the survey is "well over 20 million sites". So nowhere near 70% of the internet.
63
u/LangyMD 5h ago
PHP is used in a massive number of websites. It's probably not far from the 70% listed.
33
18
u/LordAlfredo 4h ago
Useful reference: PHP is totally banned at Amazon and Google, i.e. while AWS and GCP customers may use it in their applications the underlying services don't.
8
u/2_Spicy_2_Impeach 4h ago
I remember at AWS the joke was you’d get walked out if you committed any PHP. We ran a big event that was written in PHP before my time. It broke half the time we ran it. Moved to Go and behaved way better.
We still had legacy PHP at Ford and no one supported it 10+ years ago. Half the time you’d upgrade it, the scripts would stop working. So just had to completely rewrite it in .NET at the time.
2
•
2
u/RecordOfTheEnd 4h ago
I an currently developing an application and was last year deciding on my tech stack. I almost chose php as part of that tech stack because it's well developed and seemed pretty solid. But I decided on more modern tech stack even though I was told that was a mistake.
Glad I didn't. I mean, tomorrow I'll wish I went with it ine sure. But today I'm safer.
5
u/dekacube 4h ago
What stack did you go with, I can't imagine recommending something like a LAMP stack nowadays. But I also despise JS.
4
u/RecordOfTheEnd 4h ago
Next.js..... I actually like it a fair bit. Took some time to get used to it and learn it.
Though I've been tossing around the idea of the next version being built on Rust. Next.js just runs a little heavy on the system. It's still plenty fast, but it's a bit of a memory hog.
2
4
-27
u/Iwillgetasoda 6h ago
Php? TIL 70% of internet is thrash.
12
u/Aranthos-Faroth 5h ago
Bro, you realise most of the internet wasn’t made last week and has existed for decades at this point.
Old code doesn’t mean trash lol
19
u/pangapingus 6h ago
Not every site is a reactive SPA with serverless API gateways yet, you'd also be surprised how much IIS is still out in the wild too
2
u/Disastrous_Berry4709 5h ago
You'd also be surprised how many web sites are fully static save for some server side includes.
1
u/pangapingus 4h ago
Reactive SPAs are static IME but the thing that kills me about the modern way of doing it is the JS/dependency bloat, third party dependency calls, DOM overruling, and hydration; modern website load time waterfalls are just wild
2
u/Disastrous_Berry4709 2h ago
the javascript ecosystem has the same problems as java... frameworks of frameworks. meanwhile, the amount of cobol code just increased by 15%.
12
u/FluffyProphet 5h ago
Modern PHP is quite good and a very elegant solution for a lot of websites. It’s not something I use, because it’s not really relevant to the type of products we build, but it has its place and it excels where it is a good fit, which is for a lot of websites tbh.
12
u/serial_crusher 5h ago
That's measuring percentage of web sites, not percentage of traffic. There's probably a lot of personal web sites that haven't been updated since 2007 (and won't get patched) contributing to this number.
5
u/dshookowsky 5h ago
I would venture a guess that if 70% of those websites are running PHP, they've fallen into the "it works well enough, stop touching it" pile and no one is actively maintaining them.
1
u/AbdussamiT 5h ago
Exactly. 60% of them won’t even hear about this.
1
u/dshookowsky 3h ago
Reminds me of the stories of companies that don't realize they're running some critical infrastructure on a PC under someone's desk until after they remove it.
2
-12
u/JinpaLhawang 6h ago
Seriously. Haven't coded any PHP in 20yrs. Why is it still around and 70%?!
21
-1
-2
u/mixduptransistor 5h ago
there is no way 70% of internet sites are PHP these days. For sure isn't 70% of traffic, if that number is accurate it has to be by pure number of HTTP-responding hosts on the internet and many of those get exactly zero visits a month
-7
u/bluegreenrhombus 5h ago
I was able to patch two old radio station production servers 24/7/365 using Hermes and the free Poolside Laguna S model. My agent was able to SSH in, compile a new 7.4.33 with the patch, and deploy it to the existing Apache server. I, for one, welcome my new assistant.
5
u/jofkk 4h ago
did you test the work and make sure it was patched ok?
both of thse should fail with a Fatal error, not a seg fault.
echo '<?php ini_set("memory_limit", "2M"); $a = []; while(1) { $a[] = str_repeat("A", 1024); }' | /usr/www/cgi-bin/php7.cgi -q
echo '$a = []; while(1) { $a[] = str_repeat("A", 1024); }' | /usr/www/cgi-bin/php7.cgi -qif you get a seg fault, still vulnerable , ofcourse sub in your paths, this was from my 7.4 install as well.
-13
u/liarandathief 5h ago
They didn't specify which version has the vulnerability and which version we should upgrade to.
25
u/D0nt3L1nk 5h ago
No serious developer is looking at ABC news to decide what version they should be on. This is a non-technical article for the masses
7
6
u/Adventurous_Ad_7315 5h ago
Every version since 2004 is affected. Only the security patches newly released today are safe from this.
-21
-3
-33
138
u/plymouthvan 4h ago
This literally ate my whole frickin' day. Good reason to do a lot of cleanup on stale crap though. Silver linings at least.