The US government is coordinating with technology companies to address two PHP vulnerabilities that could affect federal agencies and American critical infrastructure, BusinessLine reported on October 22, citing a White House official. PHP’s maintainers said Wednesday they had released patches and urged users to install them immediately.
Key Takeaways
- The Office of the National Cyber Director is coordinating remediation with the FBI, CISA, NSA and others.
- Wiz said it discovered the vulnerabilities using AI tools, working with OpenAI and cybersecurity firm Calif.
- The US effort concerns potential exposure; the report did not establish successful breaches of federal systems.
Table of Contents
- PHP security response brings US agencies together
- Wiz describes AI-assisted discovery
- Hidden PHP dependencies complicate checks
- Conclusion
PHP security response brings US agencies together
The Office of the National Cyber Director was coordinating with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and other bodies to remediate the issue.
According to the White House official, the government is also working with technology companies to adopt the security fix. The reported effort is aimed at addressing potential cybersecurity problems, rather than responding to a confirmed compromise of federal agencies or critical infrastructure.
Wiz describes AI-assisted discovery
Alphabet-owned cybersecurity company Wiz said in a report published Wednesday that it found the vulnerabilities with help from several artificial intelligence tools, collaborating with OpenAI and Calif.
Wiz estimated that the vulnerability affected around 70% of the internet and had remained undetected for more than a decade. It said AI tools helped identify a fix quickly, with one researcher completing in a week work that previously would have required a world-class team months.
Hidden PHP dependencies complicate checks
Identifying affected systems presents another challenge. Cybersecurity firm Huntress said PHP powers sites using WordPress, Drupal, Joomla and Magento, and can also sit inside software that does not advertise its use.
The UK’s National Cyber Security Centre advised organizations Wednesday to identify PHP systems, check for malicious activity and consider taking them offline until the vulnerabilities can be mitigated. Separately, Cloudflare chief technology officer Dane Knecht reported early exploitation attempts and said the company had introduced protections for customers using its shielding technology.
Conclusion
The US response centers on coordinating remediation and adoption of the available patches. The scale of PHP’s use, including less-visible software dependencies, makes identifying exposed systems a key part of that work.
Read More News
Disclaimer
This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.
