Websites around the globe went dark after a serious vulnerability was discovered in PHP, a programming language used by almost 70% of websites. Government sites in the Netherlands, Germany, Belgium, Finland, and France were temporarily taken down as authorities scrambled to patch the critical weakness.
The vulnerability became public on Tuesday, prompting warnings from national security agencies in Washington and London. It means millions of websites will need to be fixed. One internet infrastructure expert said Russian state actors or organised criminals could potentially exploit the flaw to carry out cyber-attacks.
Precautionary Takedowns and Patch Release
WordPress, one of the most common website systems, uses PHP – as does Wikipedia, the messaging software Slack, and, at least historically, much of Facebook. The Wikimedia Foundation said it had taken down several systems on Wednesday as a precautionary measure until they could be patched.
The organisation behind the language issued a patch on Wednesday after researchers testing cyberdefences discovered the flaw. The US National Security Agency told all organisations using PHP to take their systems offline if they were unable to patch them immediately, stating the vulnerability could “provide a direct path to the server’s file system or database”.
Expert Warnings and Ongoing Risks
The UK’s National Cyber Security Centre gave similar advice and told organisations to check for “backdoors installed by an attacker”.
“It was very surprising and troubling because of the extent to which PHP was used around the world,” said Prof Alan Woodward, a cybersecurity expert at Surrey University. “PHP issued a patch very quickly. The big thing is for everyone using it to get that in to make sure their systems are safe.”
“The troubling part is there is going to be a long tail of websites who may not be maintained as well and they are going to remain vulnerable which means we may see weeks and months of ongoing attacks,” he added. “For the big juicy targets I hope to goodness they are being patched quickly.”
There was a window of opportunity for bad actors, he said. “There is this race and some people unfortunately don’t even know they are in the race.”
Discovery and Impact on Government Sites
OpenAI said it led a coalition of researchers that discovered the flaw and claimed “frontier AI” had been key. The researcher who found the weakness, however, said they did not use models that were not available to the general public.
In the UK, websites belonging to Edinburgh, Bristol council, and Oxford councils were taken offline. In France, local government websites, including the Paris police prefecture, went offline on Wednesday, as did the Dutch national digital identity service, the website of the house of representatives, and the site of the national cybersecurity centre.
“There’s going to be a lot of automatic exploitation of this,” said Michał Woźniak, an internet infrastructure expert. The bug might allow cryptocurrency miners to exploit vulnerable servers at other people’s expense, he said. He also said large crime organisations and Russian state actors might use the vulnerable sites as a launching pad from which to conduct distributed denial of service (DDoS) and other cyber-attacks.
The issue highlighted the poor state of internet infrastructure, said Woźniak, something which was being brought to light by advancing AI models – but which had been a long-developing problem. The underlying vulnerabilities the researcher found were decades old.
“This is an environmental problem in an industry where there’s an incentive to move fast and make changes,” he said. “There’s an incentive to deploy a thing and then never update it and not think about maintenance.”
