Much of the world woke on Wednesday (21 October) to news that PHP, a coding language most people have never heard of but which underpins roughly 70% of all websites, had a vulnerability that could be exploited by hackers, sending businesses and governments scrambling to fix it.
While the PHP flaws lie in the underlying code itself, the NSA warned that attackers could exploit them to take control of web servers, steal data, disrupt services or move through networks connected to services the average person relies on every day.
Experts say responsibility lies largely with software providers and organisations that serve customers. However, there are basic steps everyone should take to protect themselves.
Use multi-factor authentication
Multi-factor authentication (MFA) requires two forms of verification to access a protected site, such as a password plus a code sent by text message or a security key. Emily Austin, principal security researcher at cybersecurity firm Censys, recommended using unique passwords for individual websites and monitoring transactions.
"But realistically, for situations like the PHP vulnerabilities, there really isn't much an end user can do beyond hope the services they rely on either don't use PHP or have people actively working on patching," Austin said.
The PHP flaws are the latest in a series of severe software bugs made more dangerous by increasingly capable and accessible large language models. Vulnerabilities that have remained hidden in widely used software, once too obscure or complex for humans to exploit, are now much easier to uncover and weaponise.
Make hardware updates automatic
Dan Guido, chief executive and co-founder of cybersecurity firm Trail of Bits, recommended that people "turn on automatic updates for your phone, computer, and home router". Companies typically issue security updates when patches become available for known vulnerabilities, so installing them promptly reduces the window of opportunity for attackers.
Even so, consumers remain at the mercy of the services they rely on, Guido said.
"Someone visiting a website can do everything right, like use two-factor authentication, and still have their information exposed," Guido said. "You can't patch your hospital's website."
Most of the work falls on companies running services, Guido said. "They need to deploy fixes faster and limit the damage that compromised systems can cause."
Runa Sandvik, founder of Granitt and a digital security expert, said people should update apps and services on their devices whenever updates become available and remember internet-connected devices around the home.
"I can see a scenario in which some people have some sort of IoT device at home that maybe doesn't get frequent updates, maybe doesn't get any updates at all," Sandvik said. "It's worth double-checking with the vendor to see if there is anything available."
Patch, patch, patch
Dr Daniel Gardham, a lecturer at the Surrey Centre for Cyber Security and the University of Surrey, said organisations must know what software they use, apply patches promptly and check whether their systems have already been compromised. In the age of AI, attackers have the advantage, Gardham added.
"Finding vulnerabilities is becoming faster and easier, but fixing them across the range of systems that rely on this software is much harder," Gardham said. "How well organisations manage that gap will determine whether AI makes the internet safer or more vulnerable."
Beware of scammers
Whenever a major cybersecurity threat makes the news, scammers and cybercriminals will try to take advantage, said Nic Adams, co-founder and chief executive of cyberkinetics company Orcus.
Be wary of unsolicited links.
"When these headlines hit, check the affected company's instructions by opening its app or typing its website address yourself," Adams said. "An urgent message telling you to 'secure your account' deserves extra scrutiny."
Your money is safe
Banks have been preparing for this moment since frontier models emerged and have "worked extremely hard to ensure there is no more low-hanging fruit for the bad guys to go after", said Paul Benda, executive vice-president of risk, fraud and cybersecurity at the American Bankers Association.
However, Benda added that "we are in a new normal" in terms of cyber threats. Consumers need to remain vigilant, particularly in the wake of the PHP vulnerabilities, when shopping with unfamiliar retailers or using websites "where their security is not going to be as good as your bank".
Benda said consumers should avoid reusing passwords across shopping sites and consider using passkeys where possible. These digital keys are specific to individual websites, eliminating the need to enter a password and offering resistance to phishing attacks.