PHP security vulnerabilities raise concerns as experts urge users to strengthen online protection

Security vulnerabilities in PHP, a programming language used to power a large share of websites, have raised concerns about potential cyberattacks, prompting experts to advise users to strengthen their online security while organizations work to fix affected systems.

The reported flaws exist in PHP’s underlying code. The US National Security Agency (NSA) has warned that attackers could exploit such vulnerabilities to take control of web servers, steal information, disrupt services or move through connected networks.

Cybersecurity experts say the main responsibility for addressing the vulnerabilities lies with software providers and organizations operating affected services. However, users can take several precautions to reduce their exposure to online threats.

Emily Austin, principal security researcher at cybersecurity firm Censys, recommended using unique passwords for different websites, enabling multifactor authentication (MFA) and monitoring financial transactions.

MFA requires users to verify their identity through at least two forms of authentication, such as a password combined with a code sent by text message or a security key.

Austin cautioned that individual users have limited ability to protect themselves when a vulnerability exists in the underlying software used by a service. Their security ultimately depends on whether service providers have addressed the flaws and installed the necessary patches.

Dan Guido, chief executive officer and co-founder of cybersecurity firm Trail of Bits, urged users to enable automatic updates on their phones, computers and home routers. Software companies typically release security patches to address known vulnerabilities, and installing updates promptly can reduce the period during which systems remain exposed.

Guido said consumers could still have their information exposed even when they follow recommended security practices, including using two-factor authentication, if a website they rely on remains vulnerable. He said organizations must deploy fixes quickly and limit the potential damage from compromised systems.