From our other sites
The story
A vulnerability has been discovered in PHP, the programming language said to power roughly 70% of the world’s websites, causing numerous sites — including government agency pages and Wikipedia — to go temporarily offline in various countries on the 22nd. The outages are an emergency measure while the patch is rolled out, and governments worldwide are urging swift action to prevent data leaks. On 5ch, opinions split between shutting every site down at once versus patching in rotation, and the thread also lit up with down-to-earth analogies explaining how hijacked sites get turned into attack “stepping stones.”
Thu, Oct 22, 7:16 AM
Jiji Press
[Washington, Brussels — Jiji] Following the discovery of a vulnerability in the programming language PHP, government agency websites and others went offline one after another across countries worldwide as they awaited updates. The fallout from the crisis spread rapidly, given that the software is used by an estimated 70% of the world’s websites. Governments around the world called for urgent action to prevent data leaks and other damage.
Source: topics.smt.docomo.ne.jp / Read the original article
What people said
Plenty of self-proclaimed rich folks around here lol. Weird that none of them get targeted though — maybe attackers can tell there's nothing worth taking?
I think the 7.x branch wasn't covered by the patch
unlike Japanese TV and ITmedia, which love stirring up panic in the public
If we're talking about fear-mongering, why isn't the PM's official X account on that list?
Though that's actually a server-side issue lol (his site is a famously bare-bones, ancient-HTML page that's become an internet running joke)
Bring it on!
Shutting everything down at once for simultaneous maintenance is just dumb
If you don't patch it you get a leak-and-tamper free-for-all though…
What do you mean 'take turns'?
Thinking attackers will politely wait in line is the dumb part…
There might be systems out there that don't even use the vulnerable part
Saying 'take everything offline across the board' is just heavy-handed!
Just using PHP at all means you've basically got this hole built in as standard equipment
There's no site running PHP that's 'totally fine'
The attack method is public now too, so any clueless site that skips the patch is gonna get hit by trolls doing it for kicks
Back in the day hackers only went after important sites because it took effort
But now AI just carpet-bombs everything indiscriminately
So you either eat the hit or take it offline, no other choice
PHP vulnerability discovered by OpenAI's AI — "Expect a surge of similar discoveries in the coming months"
https://asahi.5ch.io/test/read.cgi/newsplus/1792623045/
Figured as much. The top priority now is finding vulnerabilities before the bad guys do
This just proves that not everyone skilled with powerful tools is a good person — honestly you'd think that was obvious from the start lol
Feels like big companies doing shady stuff behind the scenes is getting sugar-coated by pinning it all on 'attackers'
Even before AI there were places with seriously lax security. I cut ties with that one service — never want to deal with them again!
Honestly it doesn't really click for me
I get that sites handling credit cards or personal info are in trouble, but then some people are going 'my personal blog's in danger too~' which just confuses me more
Gemini and 'Chappy' (slang for ChatGPT) will do just fine lol
Easier on the mind than Wikipedia anyway, which breaks out into edit wars every now and then
Uncyclopedia (the satirical parody wiki)
What's actually dangerous is if a site ignores the official call to update
Sites stuck on old versions don't get updated
Also, if a site isn't compatible with the latest version, updating will just break it
Getting turned into a stepping stone for attacks causes all sorts of headaches though
I'm clueless about IT so that means nothing to me
What's a 'stepping stone'?
It's like an abandoned house getting turned into a hangout for delinquents or a spot for drug deals
Oh, I think I get it a little bit now
So even some random personal blog out there could end up as a base of operations for bad actors?
Guess we need to get AI to build that right away
PHP vulnerability discovered by OpenAI's AI — "Expect a surge of similar discoveries in the coming months"
https://news.yahoo.co.jp/articles/5d375ba62b0fc0c6cf876ea7f5a322d2973da453
It's not fully automatic yet, but this case is pretty much exactly what you're describing
No matter how much defensive AI you build in to find the holes,
all it takes is the attackers getting ahead by just one and you're done
A famous example is WordPress — that's PHP. I'd guess a lot of internal company workflows running Redmine too
PHP's at its peak right now and still has plenty of room to grow
If you're on X, try searching @J4ck3LSyN
You can watch the guy who leaked it to the entire world before the official announcement
Heads up though — he's currently in an all-out flame war with furious engineers from around the globe, so touch at your own risk
If he's not actually attacking anything, that makes him a white-hat hacker
Engineers from literally the whole world uniting together over this is hilarious
Background and Key Points of This Topic
PHP is widely used as the foundation for building websites around the world, including WordPress, and this vulnerability is said to potentially affect not just one specific feature but many sites that run on PHP in general. The thread’s buzz over reports that “OpenAI’s AI discovered the vulnerability” points to an era where AI can find holes before attackers do — but there are also warnings that AI is starting to be used for indiscriminate malicious scanning as well, suggesting both defense and offense are advancing in parallel with AI. There was also criticism toward the person who published vulnerability details on X (formerly Twitter) before the official announcement — a case that clashes with the security industry’s emphasis on “responsible disclosure.” As for the all-at-once shutdown response, some argued sites could simply be maintained in rotation instead, but since attackers move en masse to target weak points before patches land, handling it piecemeal risks falling behind.
※This article is excerpted and summarized from the 5ch (News Speed+) thread “[PHP Vulnerability Discovered] Website Outages Hit Countries Worldwide — Government Agencies, Wikipedia Included — Calls for “Urgent Response”.”
Leave a Reply