UK works to identify exposure after PHP security flaw
The UK government is checking whether its online services are exposed to critical flaws in PHP, the programming language behind many websites. The warning has…
The UK government says it is working to identify potential exposure in its online services after critical flaws were found in PHP, the programming language behind many websites. The warning has prompted governments and major companies to apply fixes or take vulnerable systems offline before attackers can exploit them.
A UK government spokesperson urged “all organisations, private and public, large and small” to follow guidance to protect their systems. The country’s National Cyber Security Centre (NCSC), along with counterparts in the EU and Australia, has also urged PHP users to apply the available fixes.
The consequences are already visible. Government and public websites in several countries have been taken offline as a precaution, while parts of Wikipedia were temporarily unavailable after its operator removed systems pending patches.
Agencies advise taking systems offline
The NCSC said organisations unable to fix the vulnerability immediately should consider taking affected systems offline until they can be fully protected. The US National Security Agency issued similar advice, warning that the flaws can provide access to a server’s files or database.
That can disrupt public-facing services while administrators make repairs. The Dutch cybersecurity agency went offline, Finland shut down its public web services and Wikipedia took down parts of its website. Such precautions reduce exposure while fixes are applied, but can also leave users unable to reach online information and services.
PHP supports a wide range of web platforms, including online shops, Wikipedia and WordPress, a content management system used by many websites. When someone visits a site, PHP can collect and present information for display in a browser. A vulnerability in the underlying language can therefore affect systems across different organisations, rather than being limited to one website or application.
The UK government has not said which of its services, if any, are affected. Its statement describes an ongoing effort to identify possible exposure, while the guidance focuses on checking systems and applying fixes.
Amazon reports attempted exploitation
Amazon said it identified a “PHP2Shell exploitation attempt” on October 17, before the warning became public. The attempt targeted a decoy system, known as a honeypot, according to the company’s security chief, CJ Moses.
Moses said the attempt came from an anonymous internet address, suggesting a threat actor was involved. Amazon also reported attacks on October 21, after details of the flaws had leaked on social media but before the embargo on the warning was lifted. Moses said the payloads and anonymisation methods differed, suggesting multiple actors were involved.
“The use of AI means that ‘more actors can act within hours or even minutes once technical details of a vulnerability are disclosed’,” Moses added, according to the BBC. The warning highlights the pressure on organisations to install fixes quickly once technical details become public.
The flaws had gone undetected for at least a decade, according to the BBC. Cybersecurity firm Wiz estimated that “roughly 70%” of the internet is affected, although the BBC said it could not independently verify that figure.
Anna-Maria Arabia, chief executive of the Australian Council on AI Strategy, told the BBC the incident had “demonstrated how quickly AI is changing our cybersecurity landscape”. She said what previously took months to expose a vulnerability was now taking days, and warned that threats would become more common as AI technology improves.
The NCSC’s guidance says: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”
Source: bbc.co.uk
