It’s been a week since the world’s website owners scrambled to check and update a crucial piece of the software running their servers – PHP.
Originally created as Personal Home Page by programmer Rasmus Lerdorf in the 1990s, the scripting language is used to run about 70 of the world’s websites today.
Last week, a flaw in PHP (now known as PHP: Hypertext Preprocessor) found with the help of AI threw a spanner in the works for anyone managing a website.
This so-called PHP2Shell vulnerability lets attackers take over a website or steal its data without a password. So rushed the entire world’s Web developers and managers to patch up their servers and close off the loophole.
Some governments had to take their websites offline to fix the issue. The Japanese Prime Minister Sanae Takaichi even urged people to check if their websites ran on PHP.
Now that the panic is over for many, the focus has shifted away from PHP. Unfortunately, the problems exposed in this latest episode are only going to get worse.
PHP, like much of the Internet’s core foundation, is largely managed by volunteers. The PHP Foundation, a non-profit, has only one full-time staff with 14 mostly part-time contractors.
It’s also under-funded, which may come as a surprise. How can such a fundamental piece of the digital world be so thinly resourced, you may ask.
Like it or not, that’s the story for many of the Internet’s foundational technologies.
Five years ago, the Log4j vulnerability also threatened so much of the digital devices and services that people used, by letting attackers take over the systems running them.
The software did the mundane job of logging incidents in a server. A loophole led to a race to quickly patch things up before attackers could take advantage and infiltrate millions of vulnerable machines.
The folks who fixed it were – you guessed it – volunteers at the Apache Software Foundation, a non-profit corporation which had been maintaining Log4j and other open-source software projects.
That Log4j happened as the holiday season began in 2021 didn’t help. The initial fixes fell on a team of volunteers who had already spent years refining the software. IT teams across the world would later apply the patches to keep their servers from being exposed.
Together, the two episodes reveal how much of the digital infrastructure today depends on volunteers who give their time and passion to keep things working.
The efforts behind some open-source software like Java, which is used in much of today’s digital infrastructure code, are well resourced because they are supported by commercial companies and have large, active communities.
The Apache Software Foundation is also a large organisation with thousands of volunteers, as well as sound governance and organisation.
That said, projects that are created from these organisations, such as Log4J written in Java and managed by the Apache Software Foundation, are often managed by smaller teams. In the case of the PHP Foundation, the group is infinitely smaller.
If they are scrambling to fix problems now, imagine how they might cope in future, when AI finds a lot more loopholes in the software underpinning the world’s digital infrastructure.
In PHP’s case, the flaw that sent everyone scrambling last week was discovered by researchers from United States-based cybersecurity firm Calif, using the latest AI models from OpenAI.
The company, a select few in the US granted access to advanced AI models ahead of the public, had earlier managed to create a worm that could compromise accounts on China’s WeChat messaging platform.
It also used an early version of Anthropic’s Mythos model to bypass security protocols in Apple’s macOS, according to the New York Times.
And these are the “good guys”. If cyber attackers get their hands on powerful AI tools, they could unleash damage before there is time to patch up a vulnerability.
With so much riding on such important pieces of software like PHP, it’s crucial that the non-profit organisations managing them get the support they need.
Governments can certainly chip in. Companies could help as well, especially if they sell products or services based on the open-source software maintained by volunteers.
Their work is a public good but a somewhat thankless job, holding up each small piece of today’s digital infrastructure. As AI finds more holes in the foundation, they need all the help to find a fix even faster.
