I’m not changing my password, I believe we have nothing to worry about however, it’s good to change your password once in a while for safety reasons.

Cloudflare boss reveals 'millions' of attempts to exploit PHP flawpublished at 10:01
10:01

Liv McMahon
Technology reporter

We’ve seen a lot of sites go offline as a precaution or to patch the PHP vulnerabilities flagged yesterday.

At the moment, we do not know whether any hackers have successfully exploited the flaws which surfaced in the widely used programming language.

Experts warn it could allow attackers to remotely run malicious code on affected web servers or steal data.

But some large organisations have said they’ve seen a high volume of attempts to breach their systems.

Matthew Prince, the boss of internet infrastructure firm Cloudflare, wrote on X earlier that the company saw "thousands" of attempts to exploit the PHP vulnerabilities across its network in the 10 hours before it was publicly announced.

"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now," he says.

Amazon also says it saw hackers attempt to exploit the flaws, but so far its websites are operating as normal.

If this continue to happen, that means that the era of bug bounty will be back, and this will enable people use same AI to detect vulnerabilities before the bad players discover it themselves.

We are yet to witness the advert effect of this AI generation, more shockers will happen.

I also do not see a lot of sense it on anyways. Whether you change password or not, you will still be affected by any breach. I even think that frequent update of the password will make one begin produce weak or repetitive password pattern that can be guessed.

...how will you feel after a week without bitcointtalk forum?

Welcome back. Yes.

And forget? I guess you really don't mean that part  

At the end of the day, the idea is by changing regularly, if the malicious user has access to the hashed version they might be working on solving it, but by changing it regularly you make that moot.

That's if you reset your password via the "I forgot my password" if you do it within settings, you'll need to enter your current password, this is because you're logged in and any actor who gets access to your computer could potentially try changing the password, so while logged in a password is required if doing it from settings.

However, if your password is of sufficient complexity solving the hash isn't realistic anyway.

The vulnerabilities were discovered by cyber-security researchers at the firms Calif and Wiz.

Calif, along with PHP Foundation, were part of a program started by OpenAI called Patch the Planet.

Through that program, they were given access to the AI company's advanced AI tools in order to find and fix flaws in web development language.

OpenAI said in a blog post that the discovery was "one of the most impactful security issues in recent memory". It added an internal researcher at the company had also discovered the issue around the same time as the other firms.

The flaws had gone undetected for more than a decade. By August, after a few weeks of using advanced AI tools, they were discovered.

"Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours," Wiz said in a blog post.

It has estimated "roughly 70%" of the internet is affected, though the BBC is unable to verify that figure.

Yes, but that wouldn't have prevented database access, since the php-fpm user needs expansive access to the database. However, unless an attacker was being exceptionally careful, they probably would've accidentally tripped a mandatory-access-control policy in the process of feeling out the environment, which would've left a log - and there were no such logs.

It is incredible that no one discovered these vulnerabilities, which are assumed to have existed for at least ten years. The real question in fact is who has been exploiting those vulnerabilities all this time, and what exactly they managed to collect. Welcome to the new world where AI literally tells us, "your time has passed, ours is just coming."