PHP flaw: How AI just hacked an unhackable part of the internet | About That

PHP’s Reach

PHP is a server-side programming language used to process requests and generate web pages. The video describes it as foundational infrastructure, citing its use by WordPress, Wikipedia, government websites, and online retailers. It estimates that the flaw could affect around 70% of the internet.

What the Vulnerability Does

The featured flaw involves PHP mishandling memory during certain file-upload requests. Under specific conditions, an out-of-memory error can leave a stale pointer. PHP may then disclose live server memory to an attacker who does not need to authenticate.

That memory could contain passwords, authentication tokens, API keys, or certificates. Other related flaws could potentially cause crashes or unauthorized changes to data.

Why It Was Hard to Find

The vulnerabilities are complex, can depend on PHP version and configuration, and may need to be chained together to exploit. The report says Wiz used advanced AI to analyze PHP’s large codebase and identify ways to exploit weaknesses that had reportedly existed for decades.

Severity and Response

The vulnerabilities are rated as high as 9.2 out of 10 on the CVSS scale, with some security firms assigning a 10. The video says the coordinated disclosure process broke down after a proof-of-concept video leaked before fixes were widely distributed.

A patch is available, but the report describes ongoing attacks and urges organizations running PHP to install security updates. Some organizations reportedly took websites offline as a precaution.

Remaining Risks

The extent of any damage is unknown, and some systems may still be unpatched. Even after patching, defenders may not know whether attackers accessed systems or left malicious code behind.

Reviews, Guides, or Tutorials

None. The video is an explanatory news report, not a hands-on guide.

Main Speakers and Sources

CBC host Andrew Chang provides the explanation and analogies. The report also cites Wiz’s security research and includes commentary from an unnamed cybersecurity expert.