On Wednesday afternoon, PHP — the language that powers WordPress and roughly seven out of ten websites worldwide — released an emergency update for two extremely serious vulnerabilities, uncovered with the help of artificial intelligence.
They allow anyone, without any password, to take control of the computer running a website. The attacks have already begun: anyone with a website needs to check today whether it’s been updated.
In a country of small businesses like San Marino, how many websites were built years ago and never touched again? That’s exactly why this isn’t just a story for IT specialists.
How it unfolded
On Tuesday morning, a message appeared on a programmers’ forum: two critical flaws in PHP were about to be made public. The post disappeared quickly, but screenshots spread across the web. Experts confirmed it was all true. PHP then moved up the fix by a day: Wednesday, 4pm Italian time.
In the meantime, the Netherlands shut down DigiD as a precaution — the digital identity system citizens use to access public services. Cloudflare, one of the companies protecting a large share of the web, saw the first attacks arrive even before the fix was available. And Amazon discovered it had logged an attempt as early as October 17, four days before the flaw was even announced.
Why this affects your website too
PHP isn’t an app you install on your phone. It’s the engine under the hood: a website uses it without anyone ever seeing it. You can have a well-maintained site, updated plugins and bulletproof passwords: if the engine is outdated, the door stays open. Researchers demonstrated the attack on WordPress, Drupal and Joomla, but it also works on the simplest of pages.
There’s worse news. In some cases, attackers can read portions of the server’s memory, where passwords and access keys pass through. And the flaw isn’t new: it affects every version of PHP released over the last decade and beyond.
What to do, in practice
First: find out who actually manages your website. It sounds obvious, but it isn’t. The site built by a cousin back in 2017, the agency that no longer answers calls, the hosting account still registered to a former business partner: that’s exactly where trouble hides. Today, send a message to your provider with one question only: have you updated PHP, and to which version?
Second: check the version number. The versions that fix the flaw are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later. On WordPress, you can find this under Tools, Site Health, Info, Server. If the number starts with 5 or 7, or is below 8.2, no official update will be issued: you’ll need to migrate to a newer version. It’s worth making a backup first, since older sites sometimes break during the transition. And be careful: many hosting panels let you choose the PHP version manually. If someone selected an old one years ago, it’s probably still there.
Third: if you can’t update right away, cybersecurity agencies in the United States and the United Kingdom have been clear: it’s better to take the site offline until it’s fixed. There are technical workarounds that reduce the risk, but PHP itself says it plainly: the only real solution is updating. A day offline costs far less than a server in the hands of strangers.
Fourth: once updated, change any important passwords linked to the site. If the server’s memory could have been read, this isn’t paranoia. It’s basic hygiene.
Why we’ll see more of this
The real story here, though, isn’t this particular flaw. It’s how it was found. The faulty code had been sitting there, in plain sight, for more than ten years. Turning it into a working attack was a task pushing the limits of what a human being could achieve. Researchers at Wiz, who discovered it, say that with artificial intelligence, a single person accomplished in a week what previously would have taken a team of top experts months.
Back in July, it was WordPress’s turn. A researcher put an AI to work for about ten hours and found a serious vulnerability. Cost of the operation: around $25.
In other words: finding security holes keeps getting cheaper, and keeps requiring less talent.
That’s true for defenders, and it’s true for attackers. When a patch is released, attackers compare the old code with the new one and work out exactly where to strike. With artificial intelligence, that process now takes hours: some predicted mass attacks within a quarter of an hour of the release. The gap between a patch and an attack used to be measured in days. Today, it’s measured in hours.
For years, a website was something you built once and forgot about, like a sign over a shop door. That era is over. Today a website is more like a car: it needs regular servicing, and someone needs to hold the keys. If you don’t know who your technician is, that’s already the problem.
Observatory Strategic.sm
——
If you don’t have a technician, we’re here. Strategic is available to anyone who wants to check their website, update it without breaking it, and find out whether anyone has already gotten in.
Just get in touch at strategic.sm.
