Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb

Zoe Kleinman’s frame for this one is hard to shake: a cyber scare that has people moving before the blast goes off. PHP, the language used by millions of websites, has flaws that have sat there for years. They are not easy to exploit, but the risk was serious enough that sites around the world started coming offline as a precaution.

The warning came after a leaky bit of timing turned a quiet patch into a public race. The PHP Foundation had fixed the problem and wanted to hold the news back long enough for website owners to patch their systems. That didn’t happen. Once the details got out, the countdown started.

So far, there are no reports of anyone successfully using the bugs to attack a site. But that doesn’t mean nothing is happening. Cloudflare and Palo Alto Networks have both seen millions of attempts, and nobody seems able to say yet whether any of them have done real damage. That delay matters, because affected companies may not even know if they’ve been hit.

The strange part is that this is being treated as a success story. Prof Alan Woodward of Surrey University pointed to the basic problem: defenders need warning, but warning defenders also tells attackers what to go after. Gina Neff, professor of Responsible AI at Queen Mary University, said the episode shows how AI can help a team find bugs and push out a fix. The catch, of course, is that the same tools are available to the other side.

There’s a practical snag too. The patch only works on the latest version of PHP, so older sites will have to upgrade before they can even apply it. For a lot of web teams, that is not a tidy afternoon job. It’s the sort of repair that makes developers reach for coffee and start looking very tired.