Data breaches in PHP

Even though we warn against JavaScript on many websites on our pages, we consider the Java programming language — just like PHP — to be useful and essentially reliable. What bothers us most about JavaScript is that personal data is extracted from our device simply by viewing websites (with JavaScript enabled).

However, even fundamentally reliable programming languages cannot prevent programmers from using them “unreliably.” It is generally assumed that, on average, one in every thousand lines of code contains a hidden error. It is even rarer for such an error to be severe enough to grant a hacker access to the system. When a vulnerability like this becomes known, hackers pounce on it.

Typically, they then have to (laboriously) examine the vulnerability and explore its possibilities. “Thanks to AI,” this is now much easier and, above all, faster. AI can write software and examine existing programs for correctness as well as for errors. This had already happened in August of this year during an investigation of PHP. The (negative) result was to be kept as secret as possible because the PHP language is used on over 70% of all websites — but fortunately not on ours.

Of course, the findings from August didn’t stay secret, and now hackers are using AI to find ways into systems. Government agencies, universities, and hospitals have taken their websites offline. Many companies have also followed suit since the vulnerability, known as “PHP2Shell” and registered under CVE-2026-109618 and CVE-2026-109619, became public knowledge. For website users, there is a risk that their data could be intercepted and manipulated when they enter information. An even greater risk is that hackers could gain direct access to the underlying databases and, with it, the data of all the website’s customers.

Operators of PHP websites should therefore apply the latest patches to their systems immediately as soon as they become available. Even though no major incidents have come to light so far, the mere shutdown of many websites has caused significant damage. “Artificial intelligence quickly turns vulnerabilities that were previously considered virtually impossible to exploit into real gateways,” warned Marc Henrichmann, chairman of the Parliamentary Oversight Committee for the Intelligence Services.

All we can do is refer to our articles on the problems with AI and to the FairnessJetzt event ”Not Without Us" on Sun., Oct. 31, starting at 12 p.m. at Brandenburger Tor.

Read more https://www.stern.de/digital/gravierende-sicherheitsluecke-in-php-bedroht-millionen-webseiten-38430920.html

Comment

For further confidential communication, we recommend that you include a reference to a secure messenger, such as Session, Bitmessage, or similar, below the comment text.

To prevent the use of this form by spam robots, please enter the portrayed character set in the left picture below into the right field.