There has been lots, and lots, and lots of news coverage this month about a recent security vulnerability in PHP. Yes, it really is that serious. Here’s what you need to know about the problem, both right now and in the future.
Right Now
Many websites are built using PHP. Even if your website doesn’t rely on PHP, it may have a component, such as a blog page or photo gallery, that uses PHP. To keep your website online and prohibit criminals from stealing underlying/connected data, it’s critical your PHP is patched. We suggest you confirm with your website developer and/or web host that your website has been patched. If you have software that uses a web interface or hosts an Intranet / internal website, it too needs to be kept up-to-date.
Going Forward
This vulnerability was discovered with the use of AI. As soon as vulnerability details were announced, criminals immediately began reverse-engineering the patch to exploit websites that hadn’t yet been patched. AI has quickened everything about the patch process. AI finds more vulnerabilities and enables criminals to exploit them faster. To give you a sense of this quickening, Microsoft patched 1,413 vulnerabilities in their software alone this month. This October number smashed the 2020 annual record of 1,261 vulnerabilities found, in just one month’s time. We expect this trend to continue with all software.
Bottom Line
Make sure your critical systems have a daily process to check for vulnerabilities and install the latest patches, so criminals have less time to exploit the new holes discovered by AI. When critical patches are available, install them immediately. We’ll continue doing this for our clients.
Want to see a tech tip for a specific topic? Have a cool tip you would like to share? Contact Pegasus and let us know!
