So why switch off?

Transcript

1. On Wednesday, the Dutch government took websites offline, including DigiD's.
2. Its login kept working.
3. A fix was due that afternoon.
4. By Thursday in Japan, banks had paused some online services,
5. and the tax agency closed the e-Tax homepage.
6. The cause: 2 holes in PHP, used by millions of websites.
7. By sending requests, with no password,
8. a stranger could run their own code on the server.
9. So why switch off?
10. Because the secret was already out, and even with a fix,
11. servers had to be patched and checked.
12. In 2024, PHP's team saw signs of the memory problem behind one of the flaws.
13. It couldn't show a way to break in, and the fix stalled for months.
14. PHP's foundation now calls the delay its own failure.
15. In August, the security firm Calif, using AI,
16. showed it could take over a WordPress site, and told PHP.
17. OpenAI reported it the same day.
18. A fix was set for 22 October.
19. Until then, only those preparing it were meant to know.
20. In the last week, the secret came apart.
21. The boss of the security firm Chainguard says that on Friday 16 October,
22. one of the bug finders told him only that something was coming,
23. and his team found the flaw that night with AI.
24. The next day, Chainguard joined the work and,
25. like other distributors, was given the fix.
26. That Saturday, Amazon's decoys recorded someone trying the attack.
27. How they knew, Amazon says, is unclear.
28. On Tuesday, the flaws' catalogue numbers appeared online, without details.
29. PHP moved its fix forward a day.
30. That evening, PHP says, Calif posted a video of its test attack by mistake.
31. Early on Wednesday, over 6 hours ahead of the agreed time,
32. Chainguard published its fixed builds.
33. It says attacks had already begun, and Amazon's decoys were seeing attempts.
34. PHP says those builds let attackers study the fix while others waited.
35. That afternoon, PHP published the fix,
36. ready-made only for its 4 supported versions.
37. In W3Techs' version breakdown, about half of PHP sites run 8.1 or older.
38. For those, PHP ships no ready update.
39. So agencies in Britain, the EU and the US advised:
40. if you can't update or protect it, consider taking it offline.
41. DigiD's site came back the next day, once patched and tested.
42. Amazon says attempts are now widespread.
43. The PHP Foundation says it knows of no successful use of the flaws to run code.
44. Whether anyone broke into a server before it was patched remains unknown.