Cyber security flaws may put about 70% of websites at risk | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

Most people have probably encountered it while surfing the web. But they’ve likely never seen it.It’s a computer programming language called Hypertext Preprocessor, or PHP. And it is the back end software that supports nearly 70% of the world’s websites. Now, a security researcher has discovered major flaws in the programming language using advanced OpenAI artificial intelligence models. The discovery may put PHP-powered website owners at risk of getting hacked.“Everyone’s at risk because if an attacker is able to exploit this flaw and get into a website, they can then take people’s credentials from the website and try to log in to other websites and steal their data or purchase things they’re not supposed to do,” said Nikolas Behar, a cybersecurity professor at the University of San Diego.The flaw is known as PHP2Shell and includes two bugs that hackers can take advantage of. It was found by a researcher at Cailf, a cybersecurity company dedicated to testing frontier AI to detect vulnerabilities in open-source software.Behar refers to PHP as the scaffolding that helps support websites behind the scenes. It is commonly used on popular website platforms such as WordPress and Wikipedia. However, it operates on the back end of the websites.WordPress users may be among the most at risk. People who use WordPress to run their businesses might not be aware that PHP is underpinning the site.Its prevalence only amplifies the security risks that come with the bugs.“It’s a big deal because PHP underpins a lot of servers that run websites on the internet. And most people don’t realize that that’s happening,” Behar said. “And most people have never heard of PHP. So they don’t really grasp how widespread or serious this issue actually is.”Attackers can exploit these weaknesses. For example, they could potentially gain unauthorized access to computers and operate them remotely. That leaves sites vulnerable to getting its data stolen, in addition to a host of other issues.“They (hackers) can use it to do things like mine crypto or launch more attacks, or they can use it as part of a denial-of-service attack, which is when attackers flood a particular system with so much traffic that it gets overwhelmed and goes offline,” Behar said.Many government agencies around the world temporarily took websites offline while cybersecurity experts could work out a solution. In the event of a cybersecurity vulnerability, defenders can create digital “patches” to remedy the bug.They work similarly to updates. However, applying patches is more complicated than simply tapping “install” like users might be familiar with on an iPhone or computer update. It requires expertise with the back end of a website.“The thing that probably concerns me the most is the internet of things devices that are running PHP and do not have a good way or a way at all to update them,” Behar said. “So those will remain vulnerable until they are replaced or taken offline.”PHP released a digital “patch” to fix the bugs. But Behar suspects that the average person’s website is likely left unpatched. That’s because not just anyone can apply the fix. If someone suspects their website uses PHP, they need to reach out to the website operator“It’s really important to reach out to those providers and get an answer on what they’re doing about it (the PHP flaw), because those are the people that are supposed to be patching and making sure that their systems are secure,” Behar said.It’s common practice for businesses to hire a third party to run a website or host IT services for them. To fix the PHP flaw, website operators who work for these providers must apply the patch from the back end of the website.Few explorations of the PHP flaw have been reported thus far. But publicly announcing patches could lead to problematic outcomes.While AI is finding these flaws faster than ever before, it also is providing hackers with a sort of dropped pin on where to find weaknesses. That means defenders trying to patch websites have a shorter window to resolve the problem.“So the vulnerabilities are being discovered faster, and they’re also being exploited faster. We have less notice for the defenders that the vulnerabilities are out there and a smaller amount of time before the vulnerabilities start to get exploited,” Behar said.As frontier AI models continue to advance, this cyber footrace is anticipated to intensify. Behar emphasizes that website owners should exercise caution about their sites, even if they are unsure its using PHP.”Call your website a person, call your IT person, call your nerd person and ask them, ‘hey, does this PHP vulnerability affect any of the systems that you’re maintaining for me, and what are you doing to patch it? And when will they be patched by?’” Behar said.Website owners may want to consider a temporary shutdown of sites if they cannot find a way to patch their sites. The San Diego Cyber Clinic provides free cybersecurity workshops for community members looking to learn more.

——————————————————-
Click Here For The Original Source.

Related