The UK government has responded after a critical security issue in the PHP programming language prompted warnings from cyber security chiefs and forced several organisations to take their websites offline. Scotland Secretary Douglas Alexander has confirmed that the security of next week's Budget has not been compromised by the flaw.
Websites Taken Offline Due to Critical Flaw
A researcher using AI made the discovery, which led to the Finnish government's website being partly disabled on Wednesday (August 21). Several local authorities in the UK also went offline. Oxford City Council and the City of Edinburgh Council were among the organisations to take their websites offline, and some pages for some BBC programmes were unavailable.
The programming language is used by almost 70 per cent of websites, according to cybersecurity firm Cloudflare.
Government Response and Budget Security
Mr Alexander was asked if the issue could result in major Budget leaks due to the Office for Budget Responsibility (OBR) having to take down its website. He told Times Radio on Thursday morning (October 22): "No, I've had no indication whatsoever that there's any problem in terms of a breach of Budget security.
"Indeed John Healey, who I was with yesterday in Scotland, as I understand it initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer."
The OBR's Budget analysis was mistakenly published online ahead of then-chancellor Rachel Reeves' statement to the Commons last year, allowing for early access to market sensitive information.
NCSC Advice and Exploitation Attempts
The National Cyber Security Centre (NCSC) is encouraging organisations to update to a new, fixed version of the PHP software. If a website can't be upgraded immediately, the NCSC recommends taking it offline.
As a result of the security issue, attackers had the power to potentially control any web servers running PHP remotely, including sites like WordPress and Magento.
According to Amazon and Cloudflare, many attempts at exploiting the vulnerability were spotted within hours of it being announced. Amazon Web Services' security blog noted that its Threat Intelligence team found the flaw was 'now being broadly exploited in the wild'.
Cloudflare CEO Matthew Prince wrote on X, previously known as Twitter: "In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it.
"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now."
Expert Analysis on Patch Timing
Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security (SCCS), told BBC Radio 4's Today programme: "The cat was let out of the bag rather earlier than it was supposed to have been.
"There was an embargo on this, and there's always a window between the flaw being publicly known about and it being patched so that the attackers can't successfully get in. And what happened, unfortunately, the day before the patch was out, somebody let the cat out of the bag.
"There was an initial version of the patch that was released, and so it was very easy to compare the original with the patched version and see which bit of code you needed to go and exploit. And that people like Amazon, Cloudflare, all sorts of companies that monitor what's going on on the web, saw that this was being probed for."
