PHP crisis: What you need to do as the world panics about AI cyber attacks
Only those running websites need to respond directly to the major hacking threat – but there is plenty that civilians can do to protect themselves too
This week, the world was plunged into panic after a major vulnerability was found in the code that runs the internet – and warnings that it is just the beginning.
On Wednesday, security experts announced that a vulnerability had been found in PHP, a programming language that powers some 70 per cent of all websites. The bug would let hackers easily break into websites, and so businesses and governments scrambled to fix it.
Because of the nature of the bug, only those actually running the websites can fix it directly. But there are plenty of things that everyone can do to try and stay safe – both from any consequences of this vulnerability, but also the vast number of AI-powered cyber attacks that experts predict will arrive in the months to come.
MFA, or multi-factor authentication, requires two forms of verification to access a protected site, such as a password plus a text-based code or security key. Emily Austin, principal security researcher at cybersecurity firm Censys, recommended unique passwords for individual websites, and for people to monitor any transactions.
“But realistically, for situations like the PHP vulnerabilities, there really isn’t much an end user can do beyond hope the services they rely on either don’t use PHP or have people actively working on patching,” Austin said.
The PHP flaws are the latest in a series of severe software bugs made worse by increasingly capable and accessible large language models. Long-hidden flaws in widely used software, once too obscure or complex for humans to exploit, are now much easier to surface and weaponize.
Dan Guido, CEO and co-founder of cybersecurity firm Trail of Bits, recommended people “turn on automatic updates for your phone, computer, and home router.” Companies typically issue security updates when patches are available for known vulnerabilities, so installing them promptly limits the window for bad actors.
Even so, consumers remain at the mercy of the services they rely on, Guido said.
“Someone visiting a website can do everything right, like use two-factor authentication, and still have their information exposed,” Guido said. “You can't patch your hospital's website.”
Most of the work falls on companies running services, Guido said. “They need to deploy fixes faster and limit the damage that compromised systems can cause.”
Runa Sandvik, the founder of Granitt and a digital security expert, said people need to update apps and services on their devices whenever they're available, and to not forget about internet-connected devices around the house.
"I can see a scenario in which some people have some sort of IoT device at home that maybe doesn't get frequent updates, maybe doesn't get any updates at all," Sandvik said. "It's worth double checking with the vendor to see if there is anything available."
Dr. Daniel Gardham, a lecturer at the Surrey Centre for Cyber Security and the University of Surrey, said organizations must know what software they run, patch promptly and check whether they've already been compromised. In the AI age, attackers have the advantage, Gardham added.
“Finding vulnerabilities is becoming faster and easier, but fixing them across the range of systems that rely on this software is much harder,” Gardham said. “How well organizations manage that gap will determine whether AI makes the internet safer or more vulnerable.”
Any time a major cybersecurity threat makes the news, scammers and cybercriminals will try to take advantage, said Nic Adams, co-founder and CEO of 0rcus, a cyberkinetics company.
Be wary of a "When these headlines hit, check the affected company's instructions by opening its app or typing its website address yourself," Adams said. "An urgent message telling you to 'secure your account' deserves extra scrutiny."
Banks have been preparing for this moment since frontier models came out, and have "worked extremely hard to ensure there is no more low-hanging fruit for the bad guys to go after," said Paul Benda, executive vice president of risk, fraud and cybersecurity at the American Bankers Association.
However, Benda added, "we are in a new normal" in terms of cyber threats, and consumers need to be aware, especially in the wake of the PHP vulnerabilities, when shopping with random retailers or websites "where their security is not going to be as good as your bank."
Benda said consumers should not reuse passwords across shopping sites, and should consider using passkeys where possible, which are digital keys specific to certain websites, that avoid the need to enter a password into a website and a phishing resistant.
