We don’t blame you for not knowing what ‘PHP’ is (Picture: Getty/Metro
Browsing the internet yesterday,you might have noticed a fair few websites were ‘under maintenance’ or offline altogether.
PHP is a programming language – the digital version of bricks and concrete – that about 70% of websites use.
The PHP Foundation,a non-profit that makes it,announced Tuesday that it was rolling out an update to patch ‘critical’ issues the following day.
Security agencies worldwide,from the UK and the US to China and Japan,called on websites to go dark if they can’t update,fearing cyber-attacks.
UK ministers even took 32 government services down today to carry out the fix,while also announcing a ‘Be Ready’ campaign urging Brits to prepare for,among other things,cyber attacks.
The worry,experts tell Metro,is that hackers could easily reverse engineer the patches to steal people’s personal information before they update.
But do regular people scrolling on social media or reading their work emails actually have anything to worry about?
The French government website shuttered its website (Picture: REUTERS)
Kind of – there’s a lot of ‘what ifs’ at the moment.
While the PHP update dropped yesterday afternoon,websites can be slow to adopt new patches,leaving some still unprotected.
And just because most websites use PHP doesn’t mean they’re all at risk.
‘You can’t catch this bug by browsing,’ says Shahak Shalev,global head of scam and AI research at the cyber firm Malwarebytes.
‘The danger is that attackers get to hide behind sites you already trust.’
The check-out page of a hacked shopping website,for example,could be edited to skim credit card information,Shalev adds.
PHP code decides what websites display on your screen (Picture: Reuters)
But there’s still no definite proof these PHP holes have been exploited,sats Voldemaras Kadys,head of security and platform engineering at the digital media house,Mediatech.
‘There’s no reason to stop browsing or shopping online,’ Kadys says.
‘But users should still be extra cautious about suspicious messages because we don’t know what kind of data hackers may have stolen through this vulnerability,and from which websites.’
If it’s any reassurance,there’s not much a regular web surfer can do,says Julie Nicholson,director of cyber resilience at the IT company Advania UK.
‘There’s no need to panic and nothing to install yourself,’ she says. ‘The job sits with the organisations running the sites.’
Still,Nicholson says that big cyber moments like this one are good reminders to have unique passwords,use two-factor authentication and be wary of spam emails and texts.
Ilkka Turunen,Field CTO at the software company Sonatype,says webpage providers,meanwhile,will need to act fast.
‘Defenders will need to place emphasis on modernising or decommissioning older pages,’ Turunen says.
‘The age of AI has also sped up exploitation,where it’s likely we are going to see scaled-up attacks imminently across the internet.’
Get in touch with our news team by emailing us at .
For more stories like this,check our news page.
