Tech & nature
Three letters that switched off the web
Two twenty-year-old flaws in PHP, found by an AI.
· N° 5
On Wednesday morning, the website of the Paris police prefecture read “under maintenance”. So did those of the prefectures, of the CNIL, of the Finnish government, of British, German and Belgian public services, and Wikipedia or 4chan. The cause fits in three letters: PHP, the language behind 69.3% of the websites whose technology is known, according to W3Techs.
Two flaws, rated 9.2 out of 10 on the CVSS scale, make it possible to take control of a server. They had been sleeping in the code for some twenty years: exploiting them took a chain “at the edge of what human researchers could practically achieve”, writes the security firm Wiz. AI tools flushed them out as early as August, according to the Wall Street Journal, and OpenAI claims the discovery. A post on Hacker News forced PHP to publish its patches on Wednesday at 4 p.m., a day earlier than planned. Cloudflare was already seeing the first attacks.
Twenty years in the code, three months for an AI
The NSA, Britain’s cyber security centre and the European CERT all said the same thing: if you cannot update, unplug. The interior ministry obeyed the Anssi, and the prefectures published their orders “by public notice”.
Machines find the cracks nobody could see, and it is still humans who fill them in, one server after another. How many sites are still running this morning on yesterday’s version?