Much of the world woke Wednesday to news that PHP, a coding language most people have never heard of but that underlies roughly 70% of all websites, had a hackable vulnerability, sending businesses and governments scrambling to fix it.
While the PHP glitches sit in the underlying code itself, the NSA warned that attackers could use them to take control of web servers to steal data, disrupt services or move through networks on services the average person relies on every day.
Experts say responsibility mostly lies with software providers and organizations that serve customers. But there are basic steps everyone should take to protect themselves.
Use multi-factor authentication
MFA, or multi-factor authentication, requires two forms of verification to access a protected site, such as a password plus a text-based code or security key. Emily Austin, principal security researcher at cybersecurity firm Censys, recommended unique passwords for individual websites, and for people to monitor any transactions.
“But realistically, for situations like the PHP vulnerabilities, there really isn’t much an end user can do beyond hope the services they rely on either don’t use PHP or have people actively working on patching,” Austin said.
The PHP flaws are the latest in a series of severe software bugs made worse by increasingly capable and accessible large language models. Long-hidden flaws in widely used software, once too obscure or complex for humans to exploit, are now much easier to surface and weaponise.
Make hardware updates automatic
Dan Guido, CEO and co-founder of cybersecurity firm Trail of Bits, recommended people “turn on automatic updates for your phone, computer, and home router.” Companies typically issue security updates when patches are available for known vulnerabilities, so installing them promptly limits the window for bad actors.
Even so, consumers remain at the mercy of the services they rely on, Guido said.
“Someone visiting a website can do everything right, like use two-factor authentication, and still have their information exposed,” Guido said. “You can't patch your hospital's website.”
Most of the work falls on companies running services, Guido said. “They need to deploy fixes faster and limit the damage that compromised systems can cause.”
Runa Sandvik, the founder of Granitt and a digital security expert, said people need to update apps and services on their devices whenever they're available, and to not forget about internet-connected devices around the house.
"I can see a scenario in which some people have some sort of IoT device at home that maybe doesn't get frequent updates, maybe doesn't get any updates at all," Sandvik said. "It's worth double checking with the vendor to see if there is anything available."
Patch, Patch, Patch
Dr. Daniel Gardham, a lecturer at the Surrey Centre for Cyber Security and the University of Surrey, said organizations must know what software they run, patch promptly and check whether they've already been compromised. In the AI age, attackers have the advantage, Gardham added.
“Finding vulnerabilities is becoming faster and easier, but fixing them across the range of systems that rely on this software is much harder,” Gardham said. “How well organizations manage that gap will determine whether AI makes the internet safer or more vulnerable.”
Beware of scammers
Any time a major cybersecurity threat makes the news, scammers and cybercriminals will try to take advantage, said Nic Adams, co-founder and CEO of 0rcus, a cyberkinetics company.
Be wary of unsolicited links. "When these headlines hit, check the affected company's instructions by opening its app or typing its website address yourself," Adams said. "An urgent message telling you to 'secure your account' deserves extra scrutiny."
Your money is safe
Banks have been preparing for this moment since frontier models came out, and have "worked extremely hard to ensure there is no more low-hanging fruit for the bad guys to go after," said Paul Benda, executive vice president of risk, fraud and cybersecurity at the American Bankers Association.
However, Benda added, "we are in a new normal" in terms of cyber threats, and consumers need to be aware, especially in the wake of the PHP vulnerabilities, when shopping with random retailers or websites "where their security is not going to be as good as your bank."
Benda said consumers should not reuse passwords across shopping sites, and should consider using passkeys where possible, which are digital keys specific to certain websites, that avoid the need to enter a password into a website and a phishing resistant.