Black October will go down in history as the mass cybersecurity event that put nearly 80% of the world wide web at risk of attack. Although the official fix is available, you and your online data could be vulnerable for years or more. Here’s what you can do to protect yourself from the PHP meltdown and whatever comes next.
From the outside looking in, the web is an intricate and complex network that pulls data together into one giant assembly of information. It is robust, instantaneous, powerful. Behind the scenes, though, many of today’s websites are held together with code and protocols that have proven to be stunningly fragile in the age of AI. One such element is PHP.
We’re in the thick of what may be the most arduous cybersecurity battle in human history.
PHP — or Hypertext Preprocessor — is an open-source scripting language for developers to build websites and apps. It is freely available and easy to use, making it an ideal choice for developers of any level. This is how PHP came to power almost 80% of all websites online today. So naturally, when not one but two critical PHP vulnerabilities leak out into the wild, there is reason to worry.
The pair of vulnerabilities, labeled PHP2Shell, were discovered by Wiz Research, an AI security company acquired by Google. Seemingly, these vulnerabilities have always existed in PHP going back to 2004, and it took AI to uncover them. The worst part is that hackers don’t even need login credentials or special access to break into a vulnerable site. They can simply break in and take whatever they want.
There is some good news: A patch for PHP2Shell is available and rolling out on websites now. But there is also bad news: Your data may still be at risk.
Three reasons why you’re still in danger
Implementation: Although the patch is available, it will take time for developers to implement the new versions of PHP 8 on their websites. Keep in mind that nearly 80% of the web needs an update. During this time, some websites may go down, some features may not work, and you may temporarily lose access to your data. Most of these updates will take place in the coming weeks, but some could stretch out even longer.Upgradability: Many well-maintained websites will receive the PHP update without fault, but there are many others running on old versions of PHP that cannot or will not be updated. In fact, an estimated 34.7% of websites still run on the outdated PHP 7 or lower. These sites will remain vulnerable to PHP2Shell and other security threats for the foreseeable future.Future vulnerabilities: Humans didn’t know PHP2Shell existed. Without AI, we would still likely be none the wiser. Considering how quickly frontier AI models are being used to find defects in online cybersecurity worldwide, the likelihood of future discoveries is high, bordering on certainty.
RELATED: Most of the internet is suddenly melting down, and there’s only one fix
mediaphotos/Getty Images
8 ways to protect yourself from PHP2Shell
The good news is that you’re not completely powerless in this. There are things you can do to protect yourself and your data. These require some work, though, so you’ll have to be an active participant in securing your digital footprint.
Passwords: First and foremost, you need to make sure that the passwords to your most important accounts — including your email and bank — are stored in a safe password manager. Also, make sure your passwords are all unique and complex. Do not reuse the same simple passwords! Most password managers will help you generate secure options for maximum protection.
Authentication: Enable two-factor authentication and passkeys on every account that offers it. This adds an extra layer between you and your accounts that a hacker can’t exploit without direct access to your phone. At the same time, avoid using SMS-based authentication; this is not as secure.
Updates: Make sure you update all of your devices — phones, tablets, computers, watches, activity trackers, appliances, everything — to the latest versions of their available software. This is the best way to get the latest security patches as soon as they are available. Set a reminder to do this monthly, or better yet, enable automatic updates so that your devices are always protected.
Bank alerts: Set up alerts for all purchases made on your debit cards and credit cards. With alerts, you’ll know exactly when any of your cards are used and how much was spent. Many banks offer this feature built directly into their apps on your phone, which you can enable through the in-app settings.
Credit: Freeze your credit at Experian, Equifax, and TransUnion. With a credit freeze, anyone who steals your identity is instantly blocked from taking out a loan or a credit card in your name. It also protects your credit score from any following damage. Just remember to unfreeze your credit if and when you do want to take out a new credit card or loan.
Taxes: Reach out to the IRS to get an identity protection PIN. This PIN blocks third parties from filing taxes with your Social Security number or taxpayer identification number. Note, however, that identity protection PINs only last for one year, and you will have to renew annually if you want to keep the PIN active in perpetuity.
Carrier: Reach out to your phone carrier to put a port-out PIN on your phone number. This PIN ensures that only you can move your phone number from your current carrier to a different carrier. Some carriers enable port-out PINs by default, while others will allow you to move your number without it, so you should check to see how easy it is for hackers to try to steal your phone number.
Identity protection: Invest in an online identity protection service. These groups actively monitor the dark web for signs of your information and can detect, stop, and mitigate both attempted and successful identity thefts. This way, you can know exactly if and when your data is floating around places you don’t want it to be.
What comes next?
The PHP2Shell outbreak was a wake-up call for anyone who spends time online. Your personal data is only as safe as the online security measures that defend it. Unfortunately, as AI continues to pore through websites and uncover new exploits, data breaches may become more common. For this reason, it’s a good idea to take extra steps to secure your identity, data, and accounts as much as possible.
The tips above are things you should always do, regardless of the latest cybersecurity headlines. But they are even more vital now that we’re in the thick of what may be the most arduous cybersecurity battle in human history. Do these, and you’ll be prepared for what comes next.
Like Blaze News? Bypass the censors, sign up for our newsletters, and get stories like this direct to your inbox. Sign up here!
Cybersecurity, Cyberattack, Hackers, Hacking, Tech