If One PHP Flaw Can Put 70% Of Websites At Risk, What Does That Say About The State Of Global Cybersecurity?

A critical vulnerability in PHP, a programming language used by around 70% of websites, has raised fresh questions about the security of the internet’s underlying infrastructure. Dubbed PHP2Shell, the flaws could allow attackers to execute code remotely or access sensitive information, putting vulnerable systems at serious risk.

According to The Guardian, organisations have taken websites and services offline while they assess their exposure. Patches were released on 21 October, but the incident highlights a far bigger concern and challenge. That is, how can businesses protect themselves when all it takes is just one weakness in widely used software to have such far-reaching consequences?

Ben Large, Head of Cybersecurity at Cybit

“The attack reveals exactly how unaware most businesses are of their cybersecurity stance.

“Unfortunately, the moment this vulnerability was exposed, bad actors will have started immediately to build attacks, and the bad news is that those actors need no longer be super-smart techies – with AI they can create a lot of damage with relatively little effort.

Having said that, there is much that can be done to protect against this specific threat and reduce the risk of exposure from similar attack sources.

“Firstly, get your website patched with the PHP fix. Secondly, perform a deep audit of other potential vulnerabilities, perhaps by using specialist penetration testers. Thirdly, consider adding a Web Application Firewall (WAF), such as Cloudflare, to sanitise incoming prompts and other user data before it hits your website.”

Featured in: TechRound