“Critical vulnerability” is a phrase no one in business wants to hear when it comes to their systems. So it was even worse this past Tuesday when two critical vulnerabilities were discovered in PHP, the programming language used in 70 to 80 percent of all websites worldwide. Affected systems ranged from business websites to government portals, with many choosing to take their website offline as DevOps teams worked to apply patches.
What were the two PHP vulnerabilities that were identified?
The vulnerabilities were identified by two teams—one inside OpenAI and another named Wiz, a Google-owned cybersecurity company. The vulnerabilities are not new, having been part of the PHP code base since at least 2014. Using AI tools, both groups independently discovered the flaws and flagged them to the PHPFoundation.
The vulnerabilities could allow a bad actor to run their own commands on a PHP-based server without logging in. It’s called remote code execution and it’s one of the most serious types of vulnerabilities.
How BitBakery responded
As part of our BitBakery Care program, our team constantly monitors code base and operating system news for any alerts, and takes action to address for our clients. When these vulnerabilities were identified, we immediately took action:
- Mitigate. We prepared short term mitigations to prevent these exploits until the patches were available and rolled out.
- Update systems. Once the patches were available, we immediately updated all affected customers and tested all systems to ensure they were operating as expected.
- Communicate. No one likes surprises. As soon as we learned, we alerted our clients and outlined the plan. We followed up after the patches were applied and systems were tested, and we’re continuing to follow up to ensure our clients are confident in their system and data security.
- Work with partners. Today’s software stacks include multiple vendors. We’ve been in touch with our vendors to ensure they’re updating where needed.
What’s next?
This isn’t the first vulnerability that’s going to be discovered by AI, and it certainly won’t be the last. For our clients, that’s what BitBakery Care covers. We continuously work to stay ahead of security issues, API changes, and new operating system releases to make sure your data, your business, and your clients are secure.
