Islamabad: A website can look normal to visitors while depending on vulnerable software underneath. That is the concern behind the global scramble to update PHP after researchers identified critical security flaws in the widely used programming language.
Government bodies, hospitals and other organisations have temporarily taken websites offline while securing their systems.
But what is PHP, and why does it matter?
PHP, short for “PHP: Hypertext Preprocessor”, is a programming language that runs on a website’s server. It processes instructions before sending the resulting page to a visitor’s browser.
When someone opens a news article, searches an online shop or submits a form, PHP may help retrieve information from a database and generate the response. Visitors generally see the finished page rather than the PHP code behind it.
It is widely used by content management systems, including WordPress, Drupal and Joomla. For a newsroom using such software, PHP helps connect the publishing system with the pages readers receive.
That shared dependency explains the reach of the current alert. Different websites can face the same underlying vulnerability even if they belong to unrelated organisations.
European cybersecurity authorities said the two flaws could allow attackers to execute malicious code on vulnerable servers without authentication. In plain language, an attacker could potentially make the server run unauthorised instructions without first logging in. Security updates were released on October 21.
Cybersecurity company Wiz said AI tools helped its researchers identify and demonstrate weaknesses that had remained in the code for more than a decade. The concern is that similar capabilities could also accelerate attackers’ efforts to exploit unpatched systems.
Using PHP does not automatically mean a website has been hacked. Its version, configuration and exposure matter. Equally, a temporary shutdown may be a precaution rather than evidence of a successful attack.
For website owners, updating an article, changing a password or installing a new visual theme does not fix the underlying PHP software. Administrators must check with their hosting provider that a supported, patched version is running.
NHS England’s advisory said PHP 8.1 and older releases no longer receive support and require migration. Where immediate patching is impossible, vulnerable systems may need to be temporarily disconnected.
For Pakistani businesses and newsrooms, the practical question is straightforward: who manages the server, which PHP version does it use, and has the security update been applied?
