The PHP Flaw's Real Dilemma: Warning Defenders Without Warning Attackers
The BBC reports that PHP is used by millions of websites, and the weaknesses found in it had been quietly resting there for years; they are not easy to exploit. The news was supposed to be kept quiet until everyone had a chance to fix their sites, but it leaked.
Prof Alan Woodward of Surrey University described a real dilemma: how to alert people that they need to be ready and that a patch is urgently required without alerting attackers. At the time of the report, there were no reports that anyone or anything had succeeded in using the flaws to attack a site.
AI-generated discussion · Different perspectives
The leak may have been less a disaster than a forced disclosure: the plan was to stay quiet until everyone had a chance to fix their sites.
The problem is blunter than that: everyone hears about it at the same time, and the same warning that reaches defenders can reach attackers.
The one break is that these flaws were not easy to exploit, and at the time of the report no successful attack had been reported. A warning need not mean a breach.