Two critical vulnerabilities in the PHP programming language have been identified, allowing attackers to target websites and servers running internet applications.
PHP runs on a large percentage of websites worldwide and underpins much of the internet. The vulnerabilities can reportedly be exploited to execute malicious code without logging in.
The severity is rated 9.2 on a scale of 1 to 10, according to CERT-SE, which is part of the Swedish Civil Contingencies Agency (FRA) and is responsible for handling IT incidents in Sweden.
The combination of widespread use and a serious security flaw of course makes this an urgent matter to fix, says Johan Ahlmark, communications officer at FRA.
Update immediately
A security update was released on Wednesday at 4 p.m., and Sweden’s National Cyber Security Centre is urging all businesses to update their systems immediately - or disconnect them from the internet.
If you are unable to install the update, which is highly desirable, you could consider shutting down applications connected to the internet while you wait until it is possible, says Ahlmark.
It is up to businesses themselves to decide how to proceed, depending on what they know about their own networks, he adds.
Malicious code
Alexandre Bartel is a professor and researcher in software engineering and computer security at Umeå University. He also describes the situation as urgent.
The situation has only been known about since yesterday and is still ongoing, so we don't have all the details. But from what we know so far, the vulnerabilities are very critical.
Hackers can inject malicious code, known as malware, into any server to damage, steal or activate sensitive data, or disrupt services, he says.
The danger now is that those responsible will not be able to fix the security vulnerabilities in time.
We know from experience that it takes days, weeks and even months to plug this type of vulnerability.
Rapid development
How the security hole arose and how it was discovered are still unclear, according to Bartel.
We still don't know if it was discovered by researchers or with the help of AI. Things are happening fast now, and this could just be the beginning. AI is getting better at identifying vulnerabilities in systems.
However, AI's ability to outsmart computer systems could ultimately benefit companies, he believes.
AI finding bugs before bad guys will make our computer systems more secure.
