After widely used website software was discovered to have serious security issues that hackers rushed to try to exploit, companies and governments are now scrambling to fix the vulnerabilities and flaws — including temporary site shutdowns.
The software is PHP, a programming language that runs a large share of websites and servers globally to create interactive experiences. Flaws that had been in PHP for years were uncovered by AI, and PHP developers released urgent fixes on Wednesday and told users to update immediately. However, details about the flaws were made public before the fixes were ready, and attempts by hackers to exploit them surged into the millions.
“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” Cloudflare CEO Matthew Prince said in an X post on Wednesday, referring to PHP. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.” Cloudflare is a company that watches internet traffic and can spot attack patterns early on.
PHP is behind websites that require logins, have online shopping, some blog and article publishing, and other types of media. It helps with website login flows and keeping websites protected.
According to Tate Jarrow, an expert in cybersecurity, privacy and scam protection, and the founder of scam protection company Jacana, PHP operates like a restaurant does.
“If you want to order food from a restaurant, the request goes back to the kitchen. The kitchen cooks it, and then sends it back to you,” Jarrow told HuffPost. “PHP is like the waiter that’s sending [the order] and carrying the food back to you.”
While PHP is the waiter, online databases are the cooks in the kitchen, while the restaurant itself is the website.
OsakaWayne Studios via Getty Images
On Thursday, several global banking, airline, railway, tax and government services rushed to secure their systems running on PHP. Several banks in Japan temporarily suspended online services as a precaution, but officials say no break-ins have been confirmed. The list of impacted companies has not been confirmed, and some websites and programs that took their services offline in the aftermath do not necessarily mean they were hacked.
But the average person may be wondering, “Am I in trouble?”
Tech security experts told HuffPost that, in this case, there is really not much an ordinary person can do to protect their identity, data and assets in the aftermath.
“Unfortunately, unless you have admin access to an affected system, there is nothing for you to do,” Eva Galperin, the director of cybersecurity at the Electronic Frontier Foundation, told HuffPost.
Lorrie Cranor, a professor in security and privacy technologies at Carnegie Mellon University’s CyLab, said that if you are a user on an impacted site, “The companies involved should let people know if their data were actually exposed, but it may take some time.”
What could happen if I had an account on a website or server that got hacked?
Jarrow says that the stolen data helps hackers build scams that are hard to spot.
“This data allows bad actors to create personalized attacks that target you, and they can do it at a scale because of AI,” Jarrow said. “We are in a scam epidemic.”
He used Ticketmaster as a hypothetical example.
“[The hackers] know you’re a customer because you’re in the [Ticketmaster] database. So then they send you an email saying, ‘Hey, your Ticketmaster account has been compromised. We need you to do XYZ to solve it, like this,’ and you believe it because you have a Ticketmaster account.”
“The bad news is, as a user, you’re kind of at the whim of the company,” he continued. “There’s not a lot you can do about it.”
Jarrow noted that old-school phishing indicators like misspellings, weird domains and the “Nigerian prince” scam are all irrelevant now because of AI and this access to personalized data.
“People should be really careful and really thoughtful about clicking on something from a company and do their best to verify that it’s real,” he said. “If I get a communication from somebody or a company saying, ‘There’s a problem with your account, call this number or click here,’ I will go find the phone number on the website. I’m not going to trust what’s in that email or what’s in that text message.”
What can people do to protect themselves?
Galperin recommends two-factor authentication (2FA), a security method that requires two different forms of identity verification before gaining access to an account.
Google Authenticator or Microsoft Authenticator are options that generate time-based one-time passwords that refresh every 30 seconds.
In terms of which accounts should be under 2FA, Galperin said, “If you want to protect it, you should add 2FA to it. This is like the dentist telling you to only floss the teeth you want to keep.”
It’s also better to use an authenticator app rather than text codes, Galperin said.
“An authenticator app is secure against some attacks that SMS is vulnerable to,” she said. “But if the choice is between SMS and nothing, in most cases you should choose SMS.”
While Galperin said changing a password isn’t an effective fix for this incident, Cranor noted that reusing passwords across multiple accounts is a bigger weakness.
“If you use the same password at a lot of websites, you are most vulnerable because a breach at any one of them could lead to your account being compromised at all of them,” Cranor said. “If that’s the case, I would suggest changing your password and using a different password at every website going forward.”
Some of the top-ranked options include RoboForm and 1Password, which HuffPost previously reported are good for PCs and Macs respectively, as well as Keeper and NordPass.
“[They] generate random passwords for all of your accounts,” Cranor said. “If you are already choosing different passwords for every account, then I don’t think you need to rush to change your password unless there is a breach notice.”
It’s important to remember that the PHP flaws put company servers at risk, but the protections above would not necessarily guarantee protection if this happens again.
“The reason it impacts users is that these companies can be compromised and then data can be exfiltrated,” Jarrow said. “Whatever website or whatever service, [hackers] might pull down the user database, so your email, your name, your phone number, your username. … That could be exfiltrated and used against you.”
While it does not offer complete protection, Jarrow added that people who have 2FA “are more protected than someone who doesn’t.”
“If they know that you use a server, and they exfiltrate your password, and you don’t have two-factor authentication, then, boom, I can log in as you,” Jarrow said. “Having two-factor authentication is critical for any account you have to protect against somebody having your password because it got leaked.”
