Global Websites Taken Down as Critical Cyber-Security Update Issued
Websites worldwide have been taken down or put offline as a result of a critical cyber-security update issued to address two severe vulnerabilities in the PHP programming language. The flaws, discovered by AI-powered cyber-security researchers, were found to provide a direct path to a server's file system or database, making them a high-risk target for hackers.
Multiple governments and agencies, including the Finnish government, Edinburgh council, and the BBC, have taken their websites offline as a precautionary measure until the issue can be resolved. The US National Security Agency has also advised organisations to take their systems offline if they are unable to update with the fix. The Netherlands' cyber-security agency has taken its website offline, and the UK's National Cyber Security Centre (NCSC) has urged those who use PHP to apply the fixes.
The vulnerabilities, which have been described as the "most severe ever discovered" by the tech, were found by cyber-security firm Wiz using state-of-the-art AI. The flaws had gone undetected for over a decade and are estimated to affect roughly 70% of the internet. The PHP Foundation has issued an update for the latest versions of the programming language, but those using PHP 8.1 or older are being urged to upgrade.
Cyber-security experts warn that the use of PHP is pervasive and can sit beneath public websites, content management systems, hosting platforms, and third-party products, making it a challenging task to find and manage every instance where PHP is running. The European Union Computer Emergency Response Team (CERT-EU) has given the vulnerabilities a high risk score, indicating the potential for unauthenticated remote code execution, which could allow hackers to install malware and take down websites.
