Language IO and the PHP2Shell vulnerabilities: what you need to know
If PHP has been all over your news feed this week, you’re not alone. Two flaws in the language that runs about 70% of the web made headlines, and security teams everywhere are checking their systems. Here’s the short version for Language IO customers: our platform, API and support system don’t run on PHP, and you don’t need to do anything. Below, we explain what happened and what it means for you.
What happened
The first is neural machine translation, or NMT. Google moved Google Translate to a neural system in 2016, and DeepL, Microsoft Translator and Amazon Translate work on the same basic principle. An NMT engine learns from millions of sentences that people have already translated, then predicts the most likely rendering of each new one. It’s fast and handles ordinary sentences well. It also reads each sentence more or less on its own, so a typo, an acronym or a half-finished thought gets translated exactly as typed.
The Language IO platform, our API and our support system do not run on PHP. Your data is not exposed through our systems, and you don’t need to do anything.
PHP is the programming language behind a large share of the web, including most WordPress and Drupal sites. Researchers at Wiz, OpenAI and Calif found two flaws that, under certain conditions, let an attacker run code on a web server without logging in. They reported the flaws to the PHP security team in August. The fixes and the public announcement came out together this week.
The story spread fast for a few reasons. PHP runs on roughly 70% of websites whose server language is known, according to W3Techs. The flaws reach back to PHP versions more than ten years old. And attackers started probing for them within minutes.. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has told organizations to patch immediately.
Where Language IO stands
Our product runs on a separate technology stack. Nothing that handles your conversations, translations or account data depends on PHP. That covers the Language IO platform, the API your systems connect to and the support system you use to reach our team. Your integrations and workflows stay the same.
About our marketing website
Our public website, languageio.com, is built on standard web tools, and some of those use PHP. It runs separately from the Language IO platform and doesn’t store or process customer data. Our team has updated the site to address these vulnerabilities.
What you may want to check on your side
If your organization runs its own websites or applications on PHP, your IT or security team will want to confirm they’re on a patched version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. Older versions that no longer receive PHP support should be upgraded. Many hosting providers and Linux distributions have already shipped fixes, so check their advisories too.
Questions?
Our team follows security issues like this as they come up, and we’ll contact you directly if anything ever affects your account. If you have questions now, reach out to your customer success manager.
