December 5, 2017 By Mark Samuels 2 min read

PHP received a shot in the arm with the release of a new version of the programming language that provides support for an improved password hashing algorithm and includes high-speed cryptography.

The release of PHP 7.2 includes support for the algorithm Argon2 and provides strong benefits in comparison to existing techniques. The update to the PHP programming language also replaces an outmoded cryptographic library with a modern version known as Libsodium.

Developers and IT decision-makes should view the update as welcome news since many business websites still rely on PHP programming techniques.

Understanding the Benefits of Argon2

The password hashing algorithm Argon2 has been added to the newly updated PHP core. Password hashing is one of the most basic security elements developers must consider when designing applications that accept passwords from users.

A strong hashing algorithm reduces the risk of an attacker being able to determine the original password while still allowing a database to compare the resulting hash in the long term. Argon2 is believed to offer a better alternative to bcrypt, Bleeping Computer reported, in terms of both cost efficiency and security.

Argon2, which defeated more than 20 algorithms to win the Password Hashing Competition in 2015, is now recognized as a universal internet standard by the Internet Engineering Task Force (IETF), according to Bleeping Computer. It is also ideal for the data-based protective measures used in cryptocurrencies.

The Plus Points of Libsodium

The PHP development team announced the availability of PHP 7.2 at the end of November. The release includes a range of improvements in addition to the inclusion of Argon2.

Among the most notable of these advancements was the ejection of the mcrypt cryptographic library from the core and its replacement with Libsodium. PHP’s developers have previously suggested that mcrypt, which was last updated almost a decade ago, was inhibiting the growth of the language and should be removed as quickly as possible.

InfoWorld reported that the Libsodium cryptography library is now a core extension in PHP 7.2 and provides high-speed elliptic cryptography.

Protecting Users and Data From PHP Programming Flaws

Late last year, security specialists unearthed three PHP vulnerabilities that could have had serious consequences for organizations and consumers worldwide. Then, earlier this year, reports surfaced about a rootkit that hides inside a PHP module and attacks servers through Apache modules. That was followed by fears that unfinished installations of WordPress could give attackers admin access.

IT managers must be aware of these risks and welcome the updated version of PHP. The Libsodium library should be developers’ go-to source for application-layer cryptography. Its addition to PHP is a crucial step toward implementing more concrete security for the programming language.

More from

DOD establishes Office of the Assistant Secretary of Defense for Cyber Policy

2 min read - The federal government recently took a new step toward prioritizing cybersecurity and demonstrating its commitment to reducing risk. On March 20, 2024, the Pentagon formally established the new Office of the Assistant Secretary of Defense for Cyber Policy to supervise cyber policy for the Department of Defense. The next day, President Joe Biden announced Michael Sulmeyer as his nominee for the role.“In standing up this office, the Department is giving cyber the focus and attention that Congress intended,” said Acting…

Unpacking the NIST cybersecurity framework 2.0

4 min read - The NIST cybersecurity framework (CSF) helps organizations improve risk management using common language that focuses on business drivers to enhance cybersecurity.NIST CSF 1.0 was released in February 2014, and version 1.1 in April 2018. In February 2024, NIST released its newest CSF iteration: 2.0. The journey to CSF 2.0 began with a request for information (RFI) in February 2022. Over the next two years, NIST engaged the cybersecurity community through analysis, workshops, comments and draft revision to refine existing standards…

What should Security Operations teams take away from the IBM X-Force 2024 Threat Intelligence Index?

3 min read - The IBM X-Force 2024 Threat Intelligence Index has been released. The headlines are in and among them are the fact that a global identity crisis is emerging. X-Force noted a 71% increase year-to-year in attacks using valid credentials.In this blog post, I’ll explore three cybersecurity recommendations from the Threat Intelligence Index, and define a checklist your Security Operations Center (SOC) should consider as you help your organization manage identity risk.The report identified six action items:Remove identity silosReduce the risk of…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today