00:00:00
Speaker 1: We hear a lot today about a very disturbing technology story regarding something called PHP, a programming language that underpins websites around the world. About 70% of them have been found to be affected by a flaw in PHP. It's been detected by AI. So this is one of the, depending on how you think about it, exciting or disturbing frontiers of AI technology. It will both find and repair problems and weaknesses in the coding of things, but also expose and exploit the failures in the coding of things. In this case, the disturbing thing about this is the sheer number of websites that are affected by this flaw, 70 odd percent, which means that right around the world, government websites are being taken offline, including here in Australia, to prevent Presumably people accessing information they shouldn't have access to. Lee Stark will be able to explain this from picker.com.au. Lee, good morning to you.
00:01:01
Speaker 2: Good morning, mate. How are you?
00:01:01
Speaker 1: Yeah, I'm well. So what is the vulnerability? What is the risk to Australians and people right around the world as a result of this flaw?
00:01:10
Speaker 2: Yeah, so what effectively happens, in case people are aware, is AI found two flaws, two pretty severe flaws in Australia. PHP is kind of like the operating system for how a lot of websites run. It's a good 20, 30 years old. It's been around for a really long time, so much that we all kind of use it. If anyone's listening to this and you run a WordPress blog, it runs on PHP. And so a lot of websites use it. And this exploit effectively allows anyone to basically break into a server without really trying. You still kind of have to know what you're doing, but once you're there... You don't need to get anything approved. It basically just takes advantage of a flaw deeply rooted in PHP, so much so that even the most recent versions weren't actually patched to it. It affects almost every version, which is why when we say it's roughly 70% of all websites, every single one of them is affected, even the ones that were completely up to date. And so that affects government websites that use PHP for hosting information, for putting information out there. It affects news websites, the Herald website, in Sydney and news.com.au both use WordPress, which is underpinned by PHP. It is on so many websites, it is difficult to kind of stress how important this fix is to go out there.
00:02:31
Speaker 3: Sorry, do we know which government websites are affected and should we as individuals be worried about that? And I mean this in as nice a way possible. If news.com is impacted, do I need to care about it?
00:02:45
Speaker 2: You probably don't. It's important to be aware of. I couldn't tell you how many Australian government websites operate on it. I can tell you that governments all around the world do use it. Some websites will use different platforms. PHP is the only game in town, but it's free, which makes it more likely to be used by a lot of organizations. It's not the only thing, though. In terms of regular people, most people don't have to worry about it unless they run a blog or a business. If you run a business and you have a website, it is possibly affected by that. So talk to your IT company, talk to whoever's your host immediately. The government stuff, the concern is that, and government is aware of this, which is why so many websites are being taken down to patch it immediately, is that the concern is if the servers are taken over immediately, some of that information could be made available to anyone who breaks in. That's entirely possible. It's unlikely that the data is on those servers, but it also could be that the information on them, so websites that actually provide information, may end up being compromised. They might end up defaced or showing incorrect information. And so that is also a real concern as well.
00:03:55
Speaker 1: Okay, so concern for business. It doesn't sound like this is the level of cyber threat that means your bank account is going to be accessed or something like that.
00:04:03
Speaker 2: Yeah, it's unlikely to be something like that. But that being said.
00:04:06
Speaker 1: Unlikely in that sentence, Lee, is doing a lot of heavy lifting.
00:04:10
Speaker 2: It's unlikely because we don't know what every bank uses. But keep in mind that PHP is how we show information. It's not a database. But this is why it's worth pointing out there. that this type of hack does allow a hacker to take control of the server, and those servers likely are also running databases at the same time, which is why this is such an important security fix for IT teams to get on top of, because while it might show defaced websites, if a hacker gains control of that server, it's not just the website that they're really worried about, it's everything else that's on it.
00:04:45
Speaker 1: It seems to me that one of the risks of this then would be everyone who runs a business might have a website that's updated, but there must be a stack of websites out there that are dormant or dead, but still running somewhere on a server that no one's going to patch. And whatever information they've got knocking around on the back end is just going to remain permanently vulnerable, isn't it?
00:05:08
Speaker 2: It's that. It's also the risk that because this affects billions of websites, it affects lots of different computers. And so if you're not thinking about it or you're not aware it's happening, the other concern is that hackers could take control of the server and use it for other more nefarious purposes. We talk about things like this where a server, this week alone we found that ads could actually be used as a form of auto-injection for spyware and malware. And so now that we know that that's out in the open, that pleasant thought, the idea that someone else's server, your old website that you didn't know existed or you'd forgotten about years ago, could actually be used as a way of pushing out viruses across the web. So there are deeper concerns, which is why pretty much every security expert has been running on caffeine since about 6 p.m. yesterday.
00:05:54
Speaker 3: Yeah, right.
00:05:54
Speaker 1: Okay, that's a great explanation, Lee. Thank you, leestarkpicker.com.au.
Speaker 1: We hear a lot today about a very disturbing technology story regarding something called PHP, a programming language that underpins websites around the world. About 70% of them have been found to be affected by a flaw in PHP. It's been detected by AI. So this is one of the, depending on how you think about it, exciting or disturbing frontiers of AI technology. It will both find and repair problems and weaknesses in the coding of things, but also expose and exploit the failures in the coding of things. In this case, the disturbing thing about this is the sheer number of websites that are affected by this flaw, 70 odd percent, which means that right around the world, government websites are being taken offline, including here in Australia, to prevent Presumably people accessing information they shouldn't have access to. Lee Stark will be able to explain this from picker.com.au. Lee, good morning to you.
00:01:01
Speaker 2: Good morning, mate. How are you?
00:01:01
Speaker 1: Yeah, I'm well. So what is the vulnerability? What is the risk to Australians and people right around the world as a result of this flaw?
00:01:10
Speaker 2: Yeah, so what effectively happens, in case people are aware, is AI found two flaws, two pretty severe flaws in Australia. PHP is kind of like the operating system for how a lot of websites run. It's a good 20, 30 years old. It's been around for a really long time, so much that we all kind of use it. If anyone's listening to this and you run a WordPress blog, it runs on PHP. And so a lot of websites use it. And this exploit effectively allows anyone to basically break into a server without really trying. You still kind of have to know what you're doing, but once you're there... You don't need to get anything approved. It basically just takes advantage of a flaw deeply rooted in PHP, so much so that even the most recent versions weren't actually patched to it. It affects almost every version, which is why when we say it's roughly 70% of all websites, every single one of them is affected, even the ones that were completely up to date. And so that affects government websites that use PHP for hosting information, for putting information out there. It affects news websites, the Herald website, in Sydney and news.com.au both use WordPress, which is underpinned by PHP. It is on so many websites, it is difficult to kind of stress how important this fix is to go out there.
00:02:31
Speaker 3: Sorry, do we know which government websites are affected and should we as individuals be worried about that? And I mean this in as nice a way possible. If news.com is impacted, do I need to care about it?
00:02:45
Speaker 2: You probably don't. It's important to be aware of. I couldn't tell you how many Australian government websites operate on it. I can tell you that governments all around the world do use it. Some websites will use different platforms. PHP is the only game in town, but it's free, which makes it more likely to be used by a lot of organizations. It's not the only thing, though. In terms of regular people, most people don't have to worry about it unless they run a blog or a business. If you run a business and you have a website, it is possibly affected by that. So talk to your IT company, talk to whoever's your host immediately. The government stuff, the concern is that, and government is aware of this, which is why so many websites are being taken down to patch it immediately, is that the concern is if the servers are taken over immediately, some of that information could be made available to anyone who breaks in. That's entirely possible. It's unlikely that the data is on those servers, but it also could be that the information on them, so websites that actually provide information, may end up being compromised. They might end up defaced or showing incorrect information. And so that is also a real concern as well.
00:03:55
Speaker 1: Okay, so concern for business. It doesn't sound like this is the level of cyber threat that means your bank account is going to be accessed or something like that.
00:04:03
Speaker 2: Yeah, it's unlikely to be something like that. But that being said.
00:04:06
Speaker 1: Unlikely in that sentence, Lee, is doing a lot of heavy lifting.
00:04:10
Speaker 2: It's unlikely because we don't know what every bank uses. But keep in mind that PHP is how we show information. It's not a database. But this is why it's worth pointing out there. that this type of hack does allow a hacker to take control of the server, and those servers likely are also running databases at the same time, which is why this is such an important security fix for IT teams to get on top of, because while it might show defaced websites, if a hacker gains control of that server, it's not just the website that they're really worried about, it's everything else that's on it.
00:04:45
Speaker 1: It seems to me that one of the risks of this then would be everyone who runs a business might have a website that's updated, but there must be a stack of websites out there that are dormant or dead, but still running somewhere on a server that no one's going to patch. And whatever information they've got knocking around on the back end is just going to remain permanently vulnerable, isn't it?
00:05:08
Speaker 2: It's that. It's also the risk that because this affects billions of websites, it affects lots of different computers. And so if you're not thinking about it or you're not aware it's happening, the other concern is that hackers could take control of the server and use it for other more nefarious purposes. We talk about things like this where a server, this week alone we found that ads could actually be used as a form of auto-injection for spyware and malware. And so now that we know that that's out in the open, that pleasant thought, the idea that someone else's server, your old website that you didn't know existed or you'd forgotten about years ago, could actually be used as a way of pushing out viruses across the web. So there are deeper concerns, which is why pretty much every security expert has been running on caffeine since about 6 p.m. yesterday.
00:05:54
Speaker 3: Yeah, right.
00:05:54
Speaker 1: Okay, that's a great explanation, Lee. Thank you, leestarkpicker.com.au.
