Random
Only logged in members can reply and interact with the post.
Join SimilarWorlds for FREE »

To Make A Long Story Short

Around August, OpenAI paid for the time/resources needed to audit the PHP Source code. The latter is used by 70% of web sites worldwide.

There was a known vulnerability, that had been known for years, but the PHP Open Source project overseers decided that it would be impossible to create the right conditions to exploit it.

The AI audit proved them wrong and AI devised a way to exploit it that would take minutes on small systems and hours on more complex systems.

The powers to be kept a lid on it, as thousands of engineers worked on a fix, involving 10,000 lines of code. They decided that October 22 would be the day when they announce the issue and the fix.

Then yesterday, October 20, news leaked through a hacker group. And shit hit the fun. Now the administrators of 70% of the world's web sites are scrambling to patch their systems. Some decided to shut their systems down, for a couple of days.

This does not affect sites like Facebook, etc. because they use more up to date programming languages, and PHP is part of systems that were deployed a couple of decades ago, part of something called LAMP (Linux, Aoache, MySQL and PHP).

This is the most severe breach in at least a decade.
Top | New | Old
The news update that consumed my attention this afternoon. 😑
—
The reassuring part is that the vendor patch is out and major infrastructure providers are responding quickly. The worrying part is that exploitation attempts have already begun.

——
Who took sites offline
Several governments chose precautionary outages rather than risk compromise before patching:
• France: Interior Ministry sites, including the Paris Police Prefecture, went into preventive maintenance.[lemonde]
• Netherlands: DigiD, the House of Representatives, the national cyber centre, the Port of Rotterdam, Overheid.nl, and several hospitals were taken offline.[lemonde +1]
• Finland: Valtori took government public web services offline as a precaution.[computerweekly]
• Denmark: Kombit shut down several services, including a national school-communication platform.[computerweekly]
• UK: Edinburgh Council and several BBC programme pages were affected.[computerweekly]
• Japan: Sakura Internet suspended a database-appliance function.

 
Post Comment