PHP vulnerability and protecting your data

A major cybersecurity scare is putting websites around the world at risk and Michigan universities are taking action. This is Fox 2 News at 10. I'm Jessica Dupnack. Two critical flaws have been discovered in PHP. That's a programming language used by nearly 70% of websites. The weaknesses could allow hackers to take control of vulnerable servers or steal sensitive information. Here in Michigan, the University of Michigan has warned its IT staff to secure affected systems, even recommending some be taken offline. Michigan State is also applying security updates and additional protections. The vulnerability allowed with a few requests sent to a server for an attacker to be able to take over that server, read anything that was on it, change what was on it, intercept any traffic that was going to it, repurpose it to be part of a botnet or do anything malicious with it. So these are some of the worst types of vulnerabilities. They're known as RCE, or Remote Code Execution Vulnerabilities, and they're sort of the nightmare scenario. An AI analysis first alerted the cybersecurity community to the issue, and hackers were already trying to exploit the flaws before they became public. And today, the FBI issued another warning, urging businesses and website operators to install security fixes immediately. Attackers, they don't need AI in order to do this. They know the A.I. has discovered effectively the trick to running this exploit. And now the attackers are very, very, very quickly trying to do that. We're seeing literally millions of attempted exploits every single minute. So how vulnerable are we and what about the Web sites we trust with our money, our health records and our personal information? Tech expert Joe Tavares joins us live now. Hi, Joe. How are you? I'm well. How are you? Well, you're leading our newscast and that means it must be very important. And I want you to put this in a way that's digestible for us. How bad is this situation? So it's not the worst thing that could happen because PHP runs like a lot of marketing websites and things like that. Generally, you don't see that in banking systems or government records. So it's not as bad as it could be. However, it is like having a locked door where you're very confident that it's locked and somebody comes and jiggles a handle and it pops open. What struck out to me in the articles that I was reading earlier today is before this even became public, this security weakness, if you will, hackers were already trying to exploit it. Why is that the knee-jerk reaction is to immediately see a hole and want to go through? So let's take a second and think about what a hacker is thinking. Like there's a prize at the end, like taking over a server is monetarily good for them. They want to do that. They want more bots in their botnet. they want to get into your bank account. So there is incentive there. They're constantly probing and looking. If you look at Fox 2 Detroit's website, I'm sure China, Russia, even locals are trying to get in. So it's unsurprising that people were already exploiting this, but AI has really accelerated and scaled up the capacity for that. And what happens now to PHP, now that at least we've identified that there's an issue, What happens next? So the PHP community has already pushed out a patch, and it's already been patched. Where the issue lies now is folks have to go update their website, their WordPress that might be running from, like, 2013. I had to shut a few things down. But these are just out in the world, and they're not necessarily maintained. They're old servers or whatever that may be. And, again, people can take them over, use remote code execution, and make that part of a botnet that sends out spam or hacks banks, whatever that may be. Kind of keeping it simplified a little bit for us, for common folk like myself, you know, what does this say to you big picture? When you're talking about something like this affecting 70% of the websites out there, what does that signify to you big picture in the world of AI and all of that? I think it's just, you know, a continuation pattern of everything that we've seen. things are accelerating. They're finding flaws that have been out there for decades because usually when you download a package, you're not looking at somebody else's code. This has all been running for years safely as far as we knew up until this point. And what's one takeaway if you could urge or stress to our viewers tonight when they start seeing these articles pop up on their newsfeed, when they listen to you and I talk, what's one takeaway you want folks to take from this? This probably impacts people indirectly, but 99 and a half percent of everybody is not going to have to worry about this one bit. PHP is, like I said, already been patched and those patches are getting rolled out across the internet. Okay. Joe, thank you so much. We appreciate you being here. Yeah. Thanks for having me. Welcome back. Thank you. All right. Well, the big lingering questions, what needs to happen next and what can you do to protect yourself from future issues like With this, for that, we're turning over to Fox 2's Warren Edwards doing some studying for us today on all this. Oh, I did a lot of studying, Jessica, because like you, I didn't know what all this was. And it sounds like a scary idea not having any control of your own data, as we've all been discussing. And it's definitely not a simple problem or a simple solution. And if you're just joining us, let's quickly break down what you need to know. Now, PHP is a coding language that a lot of websites use. PHP is basically the backbone that supports what you do on those websites, like adding to shopping carts and typing your personal information and using passwords. PHP is like the machine behind the curtain. But these vulnerabilities that researchers and AI agents discovered recently, that means the machine behind that curtain has the potential to be tampered with and your private information potentially hacked. So, however, cyber security expert David Derejotis, he says that while this is a serious issue, the immediate concern isn't what you're doing on the Internet. It's where you're doing it. And the ones who need to be the most worried about it right now are the websites and corporations themselves. I don't think the everyday person should be worried. This is something that the businesses and organizations all over the world really need to address and grapple with. And those businesses need to make sure that they're addressing any Internet-facing websites that they have, any databases or portals that customers and clients can access. Those are the things that need to be rectified immediately. Talk solutions and not just scare you. So we want to really underscore this. You do not need to go unplug your router or delete your accounts. Your data is still relatively secure, but it can always be more secure. Protecting your privacy is a lot easier than you might think. So we have expert advice on how you can safeguard yourself coming up on The Edge. You made that nice and easy for us to understand. And underscoring again, this isn't a panic situation. It's more to educate, keep everyone in the loop. Yeah, absolutely. You know, and it's also just to make you aware. This is what's going on, but it's really for the big businesses and big corporations. They need to be focused on this. It's like the gentleman who you were just interviewing. Like he said, 99% of us, we're good. We don't need to unplug the server, right? No, not at all. All right, Lauren. Thank you so much. Thank you. All right. We are going to keep that AI conversation going. Join us next Wednesday at 1 p.m. for Inside AI, an hour-long virtual town hall. We'll take your questions and concerns about AI and its future. That's Wednesday, October 28th at 1 p.m. during Fox 2 Detroit Live on Fox Local and Fox2Detroit.com.