Don't be surprised if your favorite website is completely down on Wednesday. A massive security risk has just been discovered, and it impacts nearly every popular website on the internet. That includes websites like Wikipedia, Slack, Spotify, and even Pornhub just to name a few.
WordPress at large is at risk, and that platform is estimated to power nearly a fourth of the internet. Though a fix is on the way, the vulnerability will be live for an entire day. The internet may not be a series of tubes, but much of it is built on a back-end technology called PHP.
This is an oversimplification, but PHP is the reason a server can retrieve pieces of information needed to build and serve web pages. PHP is how, for example, a website built on static HTML can nonetheless change dynamically based on the user's input — the technology handles the site's logic and delivery. If that doesn't quite make sense, what you ultimately need to know here is that a staggering proportion of the internet uses PHP.
Here's the problem: an unknown entity recently leaked the existence of two PHP vulnerabilities that could, in theory, allow bad actors to perform remote code execution without authentication or security credentials. This means hackers could erase information at will, or use websites to inject scripts that attack their targets. A hacker could use the PHP vulnerability to lock a system until a ransom is paid.
Really, the possibilities are as endless as they are terrifying. The PHP Foundation says it is actively working to patch these vulnerabilities out, but the fix won't be available until Wednesday, 21 Oct. 21, at 2 p.m. Websites impacted by this security breach have been advised to make the necessary preparations for an update at that time.
Already, popular destinations like 4chan, Something Awful, DeviantArt, and Fur Affinity have either gone completely offline or are currently in read-only mode. More "serious" websites for regional health-care providers, national public services and utilities are following suit. Meanwhile, websites using hosting providers like Amazon Web Services have already been warned of the issue, while services like Cloudflare are deploying emergency protections.
Extract — continue reading at the source.
