Listen again · In Conversation
PHP security flaw prompts urgent fixes for websites
· 3:42 · Technology and AI · With Maya and Leo
Leo is our columnist for technology and digital life. Thanks for joining us. Two serious security flaws in PHP were fixed on Wednesday afternoon.
Transcript
Vocabulary in this episode
- prompted urgent action
The fixes prompted urgent action by government services and other organisations.
The fixes caused government services and other organisations to act quickly.
- offline
They also advised organisations that could not update in time to consider taking affected sites offline.
Here, offline means that the websites would not be available to people using the internet.
- offline
The Netherlands’ cyber-security agency said it was taking its own website offline because of the flaws.
The agency was making its website unavailable on the internet.
- offline
Finland shut down its public web services, and the Dutch agency said it was taking its website offline because of the flaws.
The agency was making its website unavailable on the internet.
- offline
Organisations may need to weigh the risk of staying online against the disruption of taking a site offline.
Taking a site offline means making it unavailable on the internet.
- offline
Here, cyber-security agencies urged them to apply the fixes, or consider taking affected systems offline if they could not update in time.
Taking affected systems offline means stopping people from accessing them over the internet.
- inaccessible
The Edinburgh council website and several BBC programme sites were inaccessible, but no link to the PHP flaws had been confirmed.
The websites could not be reached or used by visitors.
- confirmed
The Edinburgh council website and several BBC programme sites were inaccessible, but no link to the PHP flaws had been confirmed.
No one had shown or established that the PHP flaws caused the website problems.
- versions going back to
CERT-EU, the European Union’s cyber-security service, said the flaws could affect versions going back to PHP 5, which launched in 2004.
This means that versions from PHP 5 onward, including newer ones, could be affected.
- upgrade
Users of PHP 8.1 or older were urged to upgrade.
They were urged to change to a newer version of PHP.
- severe
The vulnerabilities have been called especially severe.
Here, severe means very serious.
- severe
The cyber-security firm Wiz described the flaws as the most severe it had ever found using artificial intelligence.
Here, severe means very serious or dangerous.
- estimated
Wiz also estimated that about 70 percent of the internet could be affected.
Wiz calculated or judged that the number was about 70 percent, rather than giving an exact count.
- rely on
What is the main lesson for organisations that rely on website software like this?
Organisations that rely on this software need it to work for their websites.
- weigh the risk
Organisations may need to weigh the risk of staying online against the disruption of taking a site offline.
This means carefully comparing the danger of staying online with the problems caused by taking a site offline.
All In Conversation episodes
Sources
- RecherchePHP is used to build websites and runs on servers to implement what visitors see; it powers a large portion of the internet, though not all websites use it.
- RechercheBefore the fixes were released, PHP maintainers said they planned patches for two vulnerabilities, each rated 9.2 out of 10, and encouraged PHP users to prepare to upgrade as soon as the release became available.
