What is this PHP issue taking websites offline?

SPEAKER_1 (0:00)

From transport and energy to water and broadband, Ireland's infrastructure is being renewed and expanded. If you have workers in the field, they need the right information to work safely, accurately and efficiently. ArcGIS FieldMaps from Esri, Ireland connects your office and field teams in one mobile solution. Workers get maps, data and tools with critical information shared in real time. ArcGIS FieldMaps from Esri, Ireland Visit fieldmaps.ie to see how much time your teams could save.

Ciara Kelly (0:28)

That's fieldmaps.ie The Hard Shoulder with Ciara Kelly and Shane Colman On Newstalk with Ciara Websites across the globe have gone offline over the last day following the exposure of critical vulnerabilities in PHP, a programming language that underpins much of the internet. The exposed flaw would have allowed hackers to carry out cyber attacks and OpenAI, whose AI models helped discover the vulnerabilities, has called the issue one of the most impactful security issues in recent memories. And for more on this, I am joined by Emmet Ryan, technology journalist and columnist with the Irish Times. Good evening to you, Emmet. Okay, please explain. Because first of all, let's go right back to basics. What is PHP and how is this found and what does it mean?

Emmet Ryan (1:17)

So PHP is essentially a language that different websites use to talk to each other. So say you're shopping or anything online, something in that website needs to be able to...

Ciara Kelly (1:26)

You know me too well.

Emmet Ryan (1:27)

Well, I mean, you mean the collective view for everyone. But like something in that website needs to be able to tell the website what's happening because it doesn't speak English as its language. So this is a programming language so the website can understand what you want to do essentially. And it's basically been there since the internet as we know it existed. So it's around three quarters of all sites have it. That doesn't mean three quarters of all traffic. It's actually likely a lot more than three quarters of all website traffic has this.

It's one of those three letter terms where you probably saw that on stage it rang the faintest bell but means nothing. But essentially it's crucial to a huge, huge number of websites online. If you've gone online today, which I'm guessing anybody who listens to this has, you've been on a website and used PHP and you didn't know it. Like most things online, you only hear about them when they don't work or when something goes wrong. Okay.

Ciara Kelly (2:12)

So PHP is a language and it's embedded in the internet and everybody is using it. And it sounds like it's a good thing AI has found these things. But also it sounds like a bad thing because everything was shutting down.

So what I'm trying to get is if it's always been ever thus and been working away fine, what is AI found and why is it shutting down?

Emmet Ryan (2:34)

So essentially, the best way to describe it is normally when I'm on a show like this talking about something breaking on the internet, a very bad thing has already happened. Like somebody's robbed a lot of things or a load of things have been taken down by malicious actors. This is somewhat a good story in that it was actually found by the good guys for once ahead of time. So they found two vulnerabilities, which basically meant that had a malicious actor found these, they could have gone in without password, without anything, just gone right past that and got at all the data within there and manipulate.

Ciara Kelly (3:01)

This is how hackers work. They go in and then they...

Emmet Ryan (3:04)

Yeah, they find vulnerabilities and they go in. And so this is one which, typically speaking with these, they've been around forever and just haven't been caught because there's so many small little things, we're talking tens of thousands of millions, that finding them isn't necessarily that easy.

So one of the two had been spotted by a researcher a couple of years ago in passing as an actual human, but they hadn't really found enough concrete evidence to be correct that they were certain of it. So then OpenAI actually found these two using its own tools, which that's a double-edged sword though, because while AI can be used to find these and fix them, it can be equally used by malicious actors to find these and exploit them. So as a result, it's like, it's a good thing it was caught this time, but like in terms of sort of the overall you using the internet like that be government services, be your banking, all that sort of stuff. It is a little worrying that this of all things because of how widespread it is.