October will be remembered as a significant month in cybersecurity, with a massive event that put nearly 80% of the internet at risk of attacks. While a fix is now available, the reality is that your online data might remain exposed for quite some time. So, what can you do to safeguard yourself amid the PHP crisis and whatever else might follow?
Looking at the web, it seems like a fascinating and complicated network, seamlessly bringing together a wealth of information. It’s impressive, fast, and powerful. Yet, behind the curtain, a lot of current websites rely on code and protocols that, shockingly, can be pretty weak, especially in today’s AI landscape. One of those crucial components is PHP.
PHP, or Hypertext Preprocessor, is an open-source scripting language that developers use to create websites and applications. Because it’s accessible and user-friendly, it’s become the backbone of around 80% of all websites today. This popularity is concerning when you consider that two serious vulnerabilities in PHP have recently come to light.
These vulnerabilities, dubbed PHP2Shell, were identified by Wiz Research, an AI security firm that Google recently acquired. Shockingly, these issues have existed in PHP since 2004, and it took AI to uncover them. The worst part? Hackers can break into a vulnerable site without needing login credentials or special access; they can simply exploit the vulnerabilities and steal what they want.
There’s a glimmer of hope: a patch for PHP2Shell is currently being distributed to websites. However, the flip side is that your data may still be in jeopardy.
Three reasons why you’re still at risk
- Implementation: While the patch is out there, it won’t be an overnight fix. Developers need time to upgrade their sites to the new PHP 8 versions. Remember, nearly 80% of the web requires an update, which means some sites might experience downtime, certain features may malfunction, and access to your data could be temporarily disrupted. Most of these upgrades will occur in the next few weeks, but delays are definitely possible.
- Upgradability: Some websites will receive the PHP update with no issues, but many others are still stuck on older versions that can’t or won’t be updated. It’s estimated that approximately 34.7% of websites are still using outdated PHP 7 or even earlier. These sites will remain vulnerable to PHP2Shell and other threats for the foreseeable future.
- Future vulnerabilities: The recent discovery of PHP2Shell caught many off guard. Without AI, we might still be unaware of such vulnerabilities. Given how quickly new AI models are being deployed to find online security flaws worldwide, it seems likely that more discoveries will follow—probably sooner than we think.
8 ways to protect yourself from PHP2Shell
The good news? You can take action to protect yourself and your data. Just know that these steps require effort on your part—active involvement in securing your digital identity.
Passwords: Start by ensuring that the passwords for your most critical accounts—like email and banking—are stored securely in a reliable password manager. It’s essential that these passwords are unique and complex. Steer clear of reusing simple passwords! Thankfully, most password managers can assist you in generating secure options for optimal safety.
Authentication: Make sure to enable two-factor authentication and passkeys wherever possible on your accounts. This adds an additional barrier that a hacker can’t breach without direct access to your phone. However, it’s wise to bypass SMS-based authentication as it isn’t as secure.
Updates: Keep everything updated—phones, tablets, computers, smart devices, everything. Updating to the latest software versions ensures you get the newest security patches as soon as they’re available. Set a reminder to do this each month or, better yet, enable automatic updates so you’re always protected.
Bank alerts: Set alerts for your debit and credit card transactions. This way, you’ll instantly know when your cards are used and the amounts spent. Many banks conveniently offer this feature within their apps, which you can activate through the in-app settings.
Credit: Consider freezing your credit with the three major agencies: Experian, Equifax, and TransUnion. Freezing your credit will block anyone who tries to steal your identity from obtaining loans or credit cards in your name. It also safeguards your credit score from subsequent damage. Just remember to unfreeze your credit if you decide to take out a new credit card or loan.
Taxes: Contact the IRS to acquire an identity protection PIN. This code prevents others from filing taxes using your Social Security number or taxpayer identification number. Keep in mind that these security PINs are only valid for one year, so you will need to renew it yearly if you want to keep it active.
Carrier: Contact your mobile carrier to set a port-out PIN on your phone number. This step ensures that only you can transfer your number to a new carrier. Some carriers automatically set port-out PINs, while others allow number transfers without one, so check how vulnerable your number could be to potential hackers.
Identity protection: Think about investing in an online identity protection service. These services actively monitor the dark web for signs of your information and can detect, stop, and mitigate both attempted and successful identity theft. This means you’ll know if and when your data is in places where it shouldn’t be.
What comes next?
The PHP2Shell incident serves as a crucial reminder for anyone using the internet. Your personal data is only as secure as the protective measures in place. As AI continues its relentless search for vulnerabilities, it’s likely we’ll see more data breaches in the future. Therefore, taking additional steps to secure your identity, data, and accounts is now more important than ever.
The suggested practices are ones you should adopt all the time, not just in light of recent cybersecurity events. They carry even more weight now that we may be facing one of the most challenging cybersecurity battles in history. Follow these tips, and you’ll be better prepared for whatever comes next.
