Follow
Link copied to clipboard
Patricia is the former editor-in-chief of Kotaku, where she spent a decade writing and editing. Prior to that, she served as the Culture Editor at Polygon, and as a reporter at The Verge. Hernandez specializes in Pokémon TCG, Nintendo, and offbeat internet culture stories.
Websites and services ranging from 4Chan to Spotify are all at risk
Sign in to your Polygon.com account
Don't be surprised if your favorite website is completely down on Wednesday. A massive security risk has just been discovered, and it impacts nearly every popular website on the internet. That includes websites like Wikipedia, Slack, Spotify, and even Pornhub just to name a few. WordPress at large is at risk, and that platform is estimated to power nearly a fourth of the internet.
Though a fix is on the way, the vulnerability will be live for an entire day.
What is PHP?
The internet may not be a series of tubes, but much of it is built on a back-end technology called PHP. This is an oversimplification, but PHP is the reason a server can retrieve pieces of information needed to build and serve web pages. PHP is how, for example, a website built on static HTML can nonetheless change dynamically based on the user's input — the technology handles the site's logic and delivery.
If that doesn't quite make sense, what you ultimately need to know here is that a staggering proportion of the internet uses PHP.
What is the PHP vulnerability everyone is talking about?
Here's the problem: an unknown entity recently leaked the existence of two PHP vulnerabilities that could, in theory, allow bad actors to perform remote code execution without authentication or security credentials. This means hackers could erase information at will, or use websites to inject scripts that attack their targets. A hacker could use the PHP vulnerability to lock a system until a ransom is paid. Really, the possibilities are as endless as they are terrifying.
What websites use PHP?
The PHP Foundation says it is actively working to patch these vulnerabilities out, but the fix won't be available until Wednesday, 21 Oct. 21, at 2 p.m. UTC. Websites impacted by this security breach have been advised to make the necessary preparations for an update at that time. Already, popular destinations like 4chan, Something Awful, DeviantArt, and Fur Affinity have either gone completely offline or are currently in read-only mode.
More "serious" websites for regional health-care providers, national public services and utilities are following suit. Meanwhile, websites using hosting providers like Amazon Web Services have already been warned of the issue, while services like Cloudflare are deploying emergency protections. As the internet braces itself, there is already evidence that hackers are attempting to exploit the security breach with botnets that are scanning the internet for potential attack targets.