PHP received a shot in the arm with the release of a new version of the programming language that provides support for an improved password hashing algorithm and includes high-speed cryptography.

The release of PHP 7.2 includes support for the algorithm Argon2 and provides strong benefits in comparison to existing techniques. The update to the PHP programming language also replaces an outmoded cryptographic library with a modern version known as Libsodium.

Developers and IT decision-makes should view the update as welcome news since many business websites still rely on PHP programming techniques.

Understanding the Benefits of Argon2

The password hashing algorithm Argon2 has been added to the newly updated PHP core. Password hashing is one of the most basic security elements developers must consider when designing applications that accept passwords from users.

A strong hashing algorithm reduces the risk of an attacker being able to determine the original password while still allowing a database to compare the resulting hash in the long term. Argon2 is believed to offer a better alternative to bcrypt, Bleeping Computer reported, in terms of both cost efficiency and security.

Argon2, which defeated more than 20 algorithms to win the Password Hashing Competition in 2015, is now recognized as a universal internet standard by the Internet Engineering Task Force (IETF), according to Bleeping Computer. It is also ideal for the data-based protective measures used in cryptocurrencies.

The Plus Points of Libsodium

The PHP development team announced the availability of PHP 7.2 at the end of November. The release includes a range of improvements in addition to the inclusion of Argon2.

Among the most notable of these advancements was the ejection of the mcrypt cryptographic library from the core and its replacement with Libsodium. PHP’s developers have previously suggested that mcrypt, which was last updated almost a decade ago, was inhibiting the growth of the language and should be removed as quickly as possible.

InfoWorld reported that the Libsodium cryptography library is now a core extension in PHP 7.2 and provides high-speed elliptic cryptography.

Protecting Users and Data From PHP Programming Flaws

Late last year, security specialists unearthed three PHP vulnerabilities that could have had serious consequences for organizations and consumers worldwide. Then, earlier this year, reports surfaced about a rootkit that hides inside a PHP module and attacks servers through Apache modules. That was followed by fears that unfinished installations of WordPress could give attackers admin access.

IT managers must be aware of these risks and welcome the updated version of PHP. The Libsodium library should be developers’ go-to source for application-layer cryptography. Its addition to PHP is a crucial step toward implementing more concrete security for the programming language.

More from

Worms of Wisdom: How WannaCry Shapes Cybersecurity Today

WannaCry wasn't a particularly complex or innovative ransomware attack. What made it unique, however, was its rapid spread. Using the EternalBlue exploit, malware could quickly move from device to device, leveraging a flaw in the Microsoft Windows Server Message Block (SMB) protocol. As a result, when the WannaCry "ransomworm" hit networks in 2017, it expanded to wreak havoc on high-profile systems worldwide. While the discovery of a "kill switch" in the code blunted the spread of the attack and newly…

Emotional Blowback: Dealing With Post-Incident Stress

Cyberattacks are on the rise as adversaries find new ways of creating chaos and increasing profits. Attacks evolve constantly and often involve real-world consequences. The growing criminal Software-as-a-Service enterprise puts ready-made tools in the hands of threat actors who can use them against the software supply chain and other critical systems. And then there's the threat of nation-state attacks, with major incidents reported every month and no sign of them slowing. Amidst these growing concerns, cybersecurity professionals continue to report…

RansomExx Upgrades to Rust

IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that has been rewritten in the Rust programming language, joining a growing trend of ransomware developers switching to the language. Malware written in Rust often benefits from lower AV detection rates (compared to those written in more common languages) and this may have been the primary reason to use the language. For example, the sample analyzed in this report was not detected as malicious in the…

Why Operational Technology Security Cannot Be Avoided

Operational technology (OT) includes any hardware and software that directly monitors and controls industrial equipment and all its assets, processes and events to detect or initiate a change. Yet despite occupying a critical role in a large number of essential industries, OT security is also uniquely vulnerable to attack. From power grids to nuclear plants, attacks on OT systems have caused devastating work interruptions and physical damage in industries across the globe. In fact, cyberattacks with OT targets have substantially…