ANN ARBOR, Mich. (Michigan News Source) – The internet had a near-death experience last week. Or at least that’s what cybersecurity experts initially feared when a massive security warning threatened the aging computer code holding much of the digital world together. The October 21 scare, dubbed “PHP2Shell” and part of what’s being called “Black October,” sent businesses, banks and website operators scrambling to protect their systems from hackers. Reuters reported websites going dark and hackers attempting to exploit the vulnerabilities.
The cybersecurity scare reached far beyond the United States, prompting temporary website shutdowns in Germany, France, Belgium, the Netherlands, Finland, the Czech Republic, Japan and the United Kingdom. Among those affected were government agencies, banks, hospitals, the BBC, Wikipedia, the Internet Archive, the Port of Rotterdam, French telecommunications giant Orange and Japanese companies including airline ANA and financial giant Mitsubishi UFJ.
MORE NEWS: Two Presidents, One Mission: Trump and Obama Rally Michigan Voters
Most shutdowns were precautionary measures, allowing organizations to install security patches before hackers could exploit the vulnerabilities. The outages did not necessarily mean those systems had been hacked or customer information stolen.
The Internet’s Aging Plumbing
But was the internet really about to collapse as many predicted? Not exactly.
According to the technology podcast Connecting the Dots, produced by Snarful Solutions Group in Sacramento, California, much of the internet depends on a decades-old programming language called PHP.
The hosts, Alex and Morgan, described PHP as the programming language that “basically holds the Internet together with duct tape and dreams.”
They also called it the “silent scaffolding of the Internet.”
PHP is a programming language that works behind the scenes to make websites function, handling tasks such as processing forms, managing user accounts, retrieving information from databases and running online stores. Popular platforms like WordPress rely heavily on PHP to keep websites operating. The podcast cited statistics indicating PHP powers approximately 69% of websites whose server-side programming language is known.
MORE NEWS: Reven’s Battle With the Feds Takes Another Hit, but Appeals Court Says Fraud Is Not Proven
And while technology companies keep introducing shiny new artificial intelligence products, much of the internet is still running on software with roots stretching back more than 20 years.
So why hasn’t everyone upgraded already? Experts in the technology field have cited money, complicated systems and the possibility that updating old software could break everything else.
Old Code Meets New AI
The problem is that artificial intelligence is now being used to find security weaknesses in computer code written decades ago. Security firms Wiz and Calif reportedly used AI tools to uncover previously overlooked flaws. But the same technology that helps cybersecurity experts find problems can also help hackers discover ways to exploit them, potentially turning years of detective work into hours or even minutes.
A Digital Master Key for Hackers?
The initial warnings involved two PHP security flaws reportedly rated 9.2 out of 10 in severity.
The fear was that hackers could exploit the vulnerabilities to take control of servers remotely without passwords, potentially accessing sensitive information or disrupting websites. The podcast compared the situation to discovering that the locks on digital storefronts built over the past two decades were broken. Many organizations responded by taking systems offline rather than risking an intrusion.
How AI Gave Hackers a Head Start
University of Michigan School of Information Clinical Professor Dr. Charles R. Severance, known as “Dr. Chuck,” explained the dangerous timing of the patches coming out in an October 21 video.
According to Severance, developers were preparing security patches when word of the problem began circulating. Once hackers learned an urgent update was coming, they could examine publicly available programming changes to determine what was being repaired.
Severance explained that artificial intelligence could dramatically accelerate that detective work, potentially allowing criminals to exploit vulnerabilities before website operators installed the fixes.
He said attackers were getting ahead of the patching process. The concern was serious enough that servers supporting some of his University of Michigan teaching systems were shut down temporarily.
The security vulnerability was reportedly discovered back in August, but researchers agreed to keep the details under wraps until October 22, giving developers time to fix the problem before hackers could exploit it. That deadline, known as an embargo, was supposed to prevent the bad guys from getting a head start. Unfortunately, the information leaked before the embargo expired, raising concerns that cybercriminals could exploit the weakness before everyone had a chance to secure their systems.
One Researcher Pokes Holes in the Panic
An independent cybersecurity researcher known as J4ck3LSyN on X looked into the PHP security scare and later corrected some early claims. The researcher reported that one widely discussed way attackers might take over servers did not actually work – it failed to give them control. A related problem was found, but it was less severe, mainly caused crashes or limited issues on certain older setups, and did not allow full remote takeover. Temporary steps to reduce the risk of that narrower problem were also suggested.
However, the discovery did not eliminate the larger threat. Other researchers confirmed that the two core PHP security flaws could still allow unauthenticated remote code execution on vulnerable websites under the right conditions.
Black October: Millions of Attacks, But Little Confirmed Damage
As of October 25, the so-called Black October cybersecurity crisis appears to have caused more disruption than confirmed destruction. Although millions of attempts to exploit vulnerabilities in the widely used PHP programming language have been detected, cybersecurity researchers have found little verified evidence of successful intrusions or widespread data theft.
Government websites and other online services were temporarily shut down while administrators installed emergency security updates released October 21. However, experts warn that websites running outdated or unpatched PHP software remain vulnerable.
The internet survived Black October, but the episode exposed an uncomfortable reality: We’re building an artificial intelligence future on software infrastructure that is apparently held together by little more than duct tape, dreams and crossed fingers.
