This is a first-person article compiled from an interview with a 46-year-old product manager from Tel Aviv, Zafran Security, and the content has been edited for length and clarity.
At 6:30 a.m. on Wednesday, when I woke up, I received several messages sent around 4:45 a.m., reminding me that two vulnerabilities had been disclosed in the PHP programming language.
I immediately realized that this was a very serious matter.
Websites are running different versions of PHP, and it is estimated that about 70% of websites around the world are using it. The vulnerability in PHP is not the first time it has been discovered, but this time, attackers hardly need to perform any authentication at all.
This is a very tricky situation. If it had happened a year and a half ago, I doubt anyone would have responded with such urgency. However, this might be one of the first major incidents of its kind in the era of artificial intelligence, and the way the attackers operated has disrupted our usual response rhythms.
AI has improved detection and response times, but it also means that anyone with limited technical capabilities could exploit these vulnerabilities within just a few minutes.
My team is very concerned and must act quickly.
I was in Israel at the time, so it was 6:30 in the morning there, while it was still midnight in the United States. This time difference is advantageous for our team because we have the time to figure out what exactly happened before our clients wake up.
PHP is an open-source computer programming language used for creating websites and web applications. Its range of applications is very broad, and we immediately realized that all our clients – including large corporations and various types of companies – could be affected.
For vulnerabilities or serious flaws in the infrastructure, such as the two issues discovered in PHP, they are actually quite easy to exploit, especially when using the AI proxy. What we first realized is that even attackers with no experience at all can use these vulnerabilities to paralyze a website.
PHP Foundation indicates that the details of these vulnerabilities will be disclosed around 5 p.m. Israel time, and a fix patch will be released for the more recent PHP version. However, some details have been unofficially disclosed on an online forum. That post was deleted a few minutes later, but screenshots quickly spread among unofficial forums on the internet.
Therefore, my team and I put aside all other tasks and spent the entire Wednesday collecting informal information to see if we could reduce the risk of exploitation before the official fix was released.
How to determine if you are affected
The first step people can take is to check their own websites and web applications to find out where PHP is being used. You can also assume that, unless your website is just a very basic HTML page, it is likely that PHP is being used in some way on most of them.
The second step is to check what hints the online vulnerability scanning tools provide. Tenable, Qualys, and Rapid7 are typically the three major vendors that release detection rules and actually identify vulnerabilities. In this incident, since these vulnerabilities caused such widespread panic globally, they responded very quickly. This is also a way to understand the specific vulnerabilities in your internet assets.
After completing these steps, immediately go online to upgrade your website to the current version of PHP. The upgrade is actually very easy and free of charge. However, there will be some technical steps that need to be handled after the repair, so you may still need technical personnel to carry it out. If you do not update to version PHP, the impact on your business and website could be very, very serious.
Some people are also choosing to take their websites completely offline. I think if you have evidence that you are being targeted, that could be the right decision to make. However, 70% of the internet worldwide cannot and should not be taken offline just because of some existing vulnerabilities. If you have evidence that your site could potentially be exploited, that is an emergency measure, but it should not become a step that everyone takes.
This is not just a problem of attackers interfering with your website or web application; more seriously, they may take over your server, steal sensitive files, move laterally within your network, and then perform malicious operations such as deploying ransomware or whatever else they desire to do.
The situation has eased somewhat, but my cybersecurity team is still very concerned.
Since Wednesday, the situation has calmed down a bit, but we are still very, very worried. Fixing 70% of websites around the world cannot be done in just a minute or two.
Within just a few hours of the release of the fix plan by PHP Foundation, there were already numerous attempts to exploit it online. The speed of the attackers is getting faster and faster. I believe that in this AI era, many attackers can launch attacks within minutes, and you no longer have as much time as you did in the past.
The traditional process of the past – first defining the attack surface, then formulating a repair plan, and then finding the person responsible for carrying out the repairs, and so on – is no longer effective.
For a long time, organizations have invested a significant amount of funds in what are known as "post-event intrusion" scenarios. I believe that in the AI era, cybersecurity will shift more towards the field of "pre-event protection," allowing defense measures to be established in advance so that they can respond to attacks at any time in similar situations.
