IBL News | New York
Websites worldwide went dark after experts found a serious vulnerability in PHP, a programming language that powers much of the World Wide Web.
As bad actors could exploit a vulnerability in PHP, which powers 70% of sites, governments and corporations carried out precautionary takedowns. Site administrators scrambled to patch that critical weakness, which became public on Tuesday.
National security agencies in Washington and London issued warnings that millions of websites will need fixing.
The US National Security Agency told all organizations using PHP to take their systems offline if they couldn’t patch them immediately. It said the vulnerability could “provide a direct path to the server’s file system or database”.
The UK’s National Cyber Security Center gave similar advice, telling organizations to check for “backdoors installed by an attacker”.
Infrastructure experts reported that Russian state actors or organized criminals were trying to exploit the flaw to carry out cyber-attacks.
WordPress, one of the most common website systems, uses PHP, as do Wikipedia, Slack, and much of Facebook. The Wikimedia Foundation said it took down several systems on Wednesday as a precaution until it could patch them.
OpenAI, whose artificial intelligence models helped find the bugs, said in a blog post that, given PHP’s widespread use, it was “one of the most impactful security issues in recent memory.”
A fix was quickly available, and software developers and tech departments from Helsinki to New York scrambled to apply it, meaning outages often lasted less than a day.
But the flaw and the temporary shutdowns it provoked showed how far-reaching potential cyberattacks could be—and how deeply the internet has embedded itself in our lives.
Professor Alan Woodward, a cybersecurity expert at Surrey University, said: “It was very surprising and troubling because of the extent to which PHP was used around the world. PHP issued a patch very quickly. The big thing is for everyone using it to get that in to make sure their systems are safe.
“The troubling part is there is going to be a long tail of websites that may not be maintained as well, and they are going to remain vulnerable, which means we may see weeks and months of ongoing attacks. For the big juicy targets, I hope to goodness they are being patched quickly.”
