It seems that concerns about cybersecurity are never far away these days, whether it’s hackers stealing your data from Manchester Airport or AI bots going rogue and busting into the Australian’s Government health systems, barely a day goes by without some security scare or another. The latest has caused some serious consternation for any business with a website, so that’s every business then.

This time it was around flaws in the PHP code that runs around 70% of the world’s websites including all of the sites built in Wordpress, flaws apparently exposed by more of those scurrilous AI bots, which could allow a hacker to take control of a website and either take it down or lock out the owner.

Wait a minute. Was that ‘70% of the word’s websites’? In other words, ‘the vast majority’ of them. So, if they’re all reliant on PHP it must be some pretty serious tech then?

As it turns out, not so much.

PHP is Open Source code maintained by the PHP Foundation which is, well, quite small really. It has one full time employee, no offices and a turnover of less than £1 Million but it does have lots of volunteers and about 14 contractors funded by donations. None of which sounds especially reassuring when millions of websites are reliant on it, a concern that Elizabeth Barron, the Managing Director and the one full-time employee, shares:

“We accomplish much with a very small staff and a very limited budget. Recent events have surfaced showing how reliant people are on the PHP language. Given that reliance, it is clear that PHP is incredibly underfunded.” She added that the PHP Foundation faces a major challenge in getting to grips with AI advances. “It can lower the barrier to entry for newcomers and make professional programmers more efficient, but as the ease of writing code increases, so does the workload on open-source maintainers. It’s draining and exhausting. When you have a community of volunteers who could be doing literally anything else with their free time, this is also quite demotivating.”

Bearing in mind the fundamental reliance of so many sites on PHP, the small team behind it raises eyebrows at the very least, or more likely slack-jawed, shocked expressions with hands clasped to cheeks 'what the...'.

It also begs the question ‘how did we get here?’

Well, like much of the origins of the internet, the early days were led by scientists and engineers who were more interested in building a global network for communication rather than the business critical universe the internet has become. Tim Berners-Lee, the World Wide Web’s inventor, made his idea available for free because he was focused on creating something to allow academics to share research data. As more scientists, academics and engineers connected with it, more ideas were floated and programs created to harness it. Amongst them was PHP which was originally an abbreviation of ‘Personal Home Page’, but became a general purpose language for web development, HTML forms and for ‘talking’ to databases. From there it grew organically because it was Open Source, meaning it was free to use and freely available, so more and more computer programmers used it. The original Programmer, Rasmus Lerdorf said: “I don’t know how to stop it... there was never any intent to write a programming language... I just kept adding the next logical step on the way.”

Because PHP was there from the early days of the internet, it became a fundamental part of many products, including Wordpress. Wordpress was initially built as a blogging platform but has become the CMS used by the aforementioned 70% of the world’s sites. Wordpress is one of the main reasons for PHP’s widespread use today. New PHP versions have been added continually, developed by the relatively small community of developers who work on it. This situation which is not unique to PHP, there are numerous other pieces of code that underpin the internet and could be vulnerable including other Open Source services that are widely utilised but overseen only by small teams comparable to the PHP Foundation.

Wordpress’s popularity alone makes it a target because if hackers are successful with one Wordpress site, they potentially can hack millions of them. Wordpress is notoriously vulnerable to attacks, not only because of legacy tech such as PHP and its own code, but also its reliance on third party plugins and themes which need to be constantly updated - some even have security back-doors built in by the hackers. We’ve blogged about these issues many times, most recently https://bd2.com/insights/wordpress-hacks/

Following this recent PHP hack, we issued an immediate security notification to all our clients to reassure them their sites weren’t affected, but naturally had lots of concerned clients nervously getting in touch to double check. To be clear, anything and everything on the internet bears some level of risk, just because it’s on the internet. This includes our Umbraco websites. But Umbraco doesn’t use PHP or Wordpress, because of the vulnerabilities outlined and the obvious shortfall in resilience that the scale of resource supporting them implies. By using Microsoft technologies [Umbraco is built with ASP.Net] and our own software development, we take advantage of the investment Microsoft makes in cybersecurity, which is over $1 Billion annually. This is backed a global team of over 3,500 cybersecurity experts and 34,000 full-time engineers dedicated to platform integrity and threat monitoring. Microsoft processes more than 100 trillion security signals daily, actively blocking millions of malware files and screening billions of emails for phishing and threats.