Global Cyber-Security Flaw Affects Millions of Websites
A global cyber-security issue has left millions of websites vulnerable to hacking, with 32 UK government services currently unavailable and four partially unavailable. The problem lies within the PHP programming language, which is used to collect and present information on the web.
The UK's National Cyber Security Centre (NCSC) has confirmed that the scale of the issue is "unprecedented" and will be "universally felt." The NCSC's chief technology officer, Olly Whitehouse, stated that there are "no indications" of any successful breaches, but the agency is "starting to see positive confirmation" that affected organisations are taking action.
The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) has warned that multiple vulnerabilities have been identified in PHP and are being exploited in the wild. The agency has advised organisations to patch all affected assets immediately and isolate internet-facing applications from public networks until the security fixes are applied and verified.
The UK government has taken proactive measures to address the issue, with technology minister Baroness Lloyd of Effra stating that the National Cyber Security Centre was briefed by OpenAI last week on the potential vulnerability. The government has alerted departments to the vulnerability and advised them to identify potential affected systems, assess their exposure, and prepare to implement mitigations and security updates.
Small businesses with websites, including those built using WordPress, are advised to check with their hosting company or web developer to see if the PHP security fixes have been applied. If not, they should consider temporarily taking their website offline until the issue is resolved.
The UK's National Cyber Security Centre recommends considering this option where updates or temporary protections cannot be applied quickly enough. Cyber-security lecturer Rory Hopcraft has called on the government to ensure its infrastructure is up to date and employing the tools and practices it should already be using and following.
The situation is being closely monitored, with the government continuing to work with departments to maintain the security resilience and availability of public services.
