PHP cyber-security issue hitting millions of websites
A critical flaw in PHP has triggered a global scramble to patch websites, with Cloudflare reporting millions of hacking attempts but no evidence they…
A critical flaw in software used across the web has forced organisations to patch or take services offline. The php cyber-security issue hitting websites worldwide has prompted millions of hacking attempts, Cloudflare said, although it reported no evidence the attempts succeeded.
The vulnerability affects PHP, a programming language used to build websites. Government portals, health services and other sites have been disrupted as operators work to install an emergency fix released by PHP developers on Wednesday.
Some services are already returning. Others remain exposed until their operators patch the flaw or disconnect affected systems.
PHP collects information for websites and presents it in a readable form. The technology supports platforms including online shops, Wikipedia and WordPress, the content management system used by many websites.
The flaw could allow attackers to take control of affected web servers without authentication and steal sensitive data, Paul Spain, chief executive of Gorilla Cyber Security, told the BBC. He estimated it could affect “millions and millions” of websites.
Cloudflare said its network saw “millions” of hacking attempts after the vulnerability became public. The company reported no evidence those attempts were successful.
The disruption is already visible. The Office for Budget Responsibility and NHS Scotland took their sites offline, according to the BBC live report. Some parts of Wikipedia were unavailable, while Amazon detected an attempt to exploit the flaws.
Wikimedia, the organisation behind Wikipedia, took some systems down as a precaution, the BBC reported. The Finnish government, Edinburgh council and the BBC also took sites or pages offline. Scotland’s public organisations, including councils and health boards, were among those affected.
Emergency patches and warnings
PHP developers released patches on Wednesday to address vulnerabilities that had gone undetected for years. “All PHP users are strongly encouraged to update immediately,” the company said.
The US National Security Agency advised organisations that could not patch immediately to take their PHP systems offline. It warned that the flaw could provide a “direct path” to a system’s database and said the risks required immediate patching across US government departments and agencies.
The UK’s National Cyber Security Centre issued similar advice and told organisations to check for “backdoors installed by an attacker”. Security agencies in the EU, Singapore and Australia also issued alerts, according to the BBC.
Operators face a practical choice: apply the fix, or take a vulnerable service offline while they work out how to secure it. That can leave users unable to access websites, but keeping an unpatched system online could expose its data and services to attack.
Cyber-security lecturer Rory Hopcraft of the University of Plymouth said the patch became available the previous evening, UK time, and that services were beginning to return. He said governments should ensure their infrastructure is up to date and follow the security practices they expect other organisations to use.
“If you use PHP in your stack, you need to look at it, you need to fix it,” BBC cyber correspondent Joe Tidy said. If operators cannot fix the issue, he said, they need to take their sites offline.
The speed of potential attacks is a concern. Tidy compared the flaw with a cyber-security issue in 2021, when criminals took 15 days to begin carrying out malicious activity. “Now we have AI, the criminals have taken half a day to come up with something usable,” he said.
Researchers also warned that the risk may grow as technical details become public. Salil Kanhere, a cyber-security researcher at UNSW Sydney, said more attempts to exploit the flaws were likely in the coming weeks. Smaller organisations with limited security resources could face greater risk if their websites are poorly maintained.
For individuals, Joe Tidy said banking systems and other organisations already have protections in place, and described direct harm to individuals as generally limited. He said the greater concern would be an attack beyond the ransomware, extortion and data theft incidents people are already used to.
Cyber-security researcher Jill Slay of the University of Adelaide said it would be “disastrous” if hackers or countries weaponised the flaw to seize private data. The immediate instruction from PHP’s developers remains: “All PHP users are strongly encouraged to update immediately.”
Source: bbc.com
