This week the news media were all agog about how AI had discovered two vulnerabilities that affect websites that use PHP – which is most websites. According to the media, this was a devastating blow that took down 70% of all websites, would end life as we know it, yadda-yadda-yadda. As usual, the media were light on information, heavy on drama.<\/p>\n\n\n\n\n\n\n\n
First, these vulnerabilities were known. Human had discovered them quite a while back. They weren’t given high priority because to use them would require expertise and effort. Someone used AI to find ways to exploit these vulnerabilities, which is why they suddenly became high priority.<\/p>\n\n\n\n
Compounding the problem, the exploit was accidentally publicized prematurely, necessitating a rush to publish the patches. Usually exploits are not made public until the patch has been created and published.<\/p>\n\n\n\n
I don’t want to trivialize the severity of these vulnerabilities. They could give a bad actor complete control over an compromised computer, which would allow them to do whatever they wanted. That’s really bad, no matter how you look at it.<\/p>\n\n\n\n
As a precaution while waiting for the patches to be pushed out, some experts advised people to take down their websites. Evidently some governmental websites were taken down. This was done as a precaution. It was not caused by the vulnerabilities. There have not been confirmed reports of any website being harmed by these vulnerabilities. Within a few hours the patches were released and applied.<\/p>\n\n\n\n
Many YouTubers chose to go batshit crazy over this. They claimed that 70% of the Internet was taken down, that it was AI which discovered these vulnerabilities, and that there was no easy fix. All of this was flat-out wrong.<\/p>\n\n\n\n
It is true that PHP is used in about 70% of known websites. This number is an estimate. Even if the numbers are slightly wrong, PHP runs a huge percentage of websites. The potential for harm was enormous.<\/p>\n\n\n\n
A handful of websites shut down voluntarily, in order to avoid getting compromised. Despite this, I had no problem accessing every website I visited. Not one had been shut down. Probably some people did experience some outages; but they weren’t widespread.<\/p>\n\n\n\n
The patches were out within hours of the news. For many websites, these patches were applied automatically. The webmaster didn’t have to worry about it. This was the case with my websites. By the time I learned of the problem, my PHP had been fixed. I didn’t even need to take my websites down.<\/p>\n\n\n\n
I find it annoying that so many YouTube authors decided to make outlandish and hysterical claims. Of course, putting up a video that says, “PHP security flaw discovered and patched” doesn’t get the clicks. Throw in something about AI and how the Internet was taken down, and you’ve got a big following.<\/p>\n\n\n\n
At any rate, the dreadful PHP Apocalypse is over, and life goes on.<\/p>\n","protected":false},"excerpt":{"rendered":"
This week the news media were all agog about how AI had discovered two vulnerabilities that affect websites that use PHP – which is most websites. According to the media, this was a devastating blow that took down 70% of … Continue reading