Cyber security officials have warned UK organisations that their websites may need to be taken offline after a researcher using artificial intelligence discovered a critical security issue in the PHP programming language. The Finnish government's website was among several to be partly disabled on Wednesday, along with websites of UK local authorities including Oxford City Council and the City of Edinburgh Council. Some BBC programme pages were also unavailable.
Impact on UK organisations
The Office for Budget Responsibility said it had followed guidance to take its website offline in view of the critical security issues affecting PHP. Some government online services may be temporarily unavailable while steps are taken to maintain security, but any impact is expected to be minimal, and no large public-facing critical services are thought to have been affected.
The security issue could allow attackers to remotely control any web servers running PHP, which is used by almost 70% of websites, according to cybersecurity firm Cloudflare. It underpins popular platforms such as WordPress and Magento.
Exploitation attempts surge
Cloudflare chief executive Matthew Prince reported a dramatic surge in attempts to exploit the issue once it was announced. He wrote on X: "Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now."
The National Cyber Security Centre (NCSC) has urged organisations to update to a new, fixed version of the software. If software cannot be immediately upgraded, organisations should consider taking their websites offline, the NCSC said.
Government response and wider warnings
A Government spokesperson said: "Work is already under way across Government to actively identify and patch any potential exposure. We encourage all organisations, private and public, large and small, to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems."
The cyber division of the US National Security Agency warned that weaknesses in the software could provide a direct path to the server's file system or database. The Wall Street Journal reported that the flaw was discovered in August by Ryan Austin, a researcher at the cybersecurity company Calif, using an advanced AI model developed by OpenAI.
PHP developers had reportedly planned a security update on Thursday, but the release was brought forward after details of its work to address the vulnerabilities leaked online. OpenAI, which runs ChatGPT, said it has been leading a team of researchers working to address the critical flaw in PHP over the past two months and supported its developers as it led the fixes. The company described the incident as "one of the most impactful security issues in recent memory," adding that while AI can help uncover issues, it can also aid attackers. "To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a defender's window for maintainers and security providers to prepare fixes and protections ahead of disclosure," it said.
Ciaran Martin, former head of the NCSC, told Times Radio that the vulnerabilities had the potential to create a significant loss of personal data. He said: "You're talking about the potential to take the personal details of cards, including those crucial three digits on the back and so forth, so people will want to be on the alert for scams in future. There's more scope for that. You're talking potentially for ransomware attackers, not to be able to do ransomware directly as a result of this, but to get a foothold into the organisation. You're talking about easier to impersonate CEOs because you get to know them better. All that sort of scamming and fraud and so forth gets turbocharged."
