Auto Amazon Links: No products found.
Following the recent discovery of significant cyber-security weaknesses in PHP, one of the world’s most widely used programming languages, organisations and businesses have been urgently working to update their systems. The vulnerabilities, described as “critical” by PHP developers, caused disruptions to websites globally over Wednesday and Thursday. This back-end language, integral to web development for several decades, underpins millions of sites, prompting swift protective actions to prevent exploitation.
Security researchers alerted that the flaws pose a severe threat, potentially enabling hackers to breach numerous websites that rely on PHP if patches are not promptly applied. Among those taking preventative measures was the UK government, which temporarily took some of its sites offline. Although no successful cyber-attacks have been officially reported to date, experts caution that the full consequences of these vulnerabilities may only become evident over the coming months. Downing Street acknowledged that certain government services were affected during ongoing security updates.
Tech minister Baroness Lloyd of Effra informed the House of Lords that 32 government services were currently unavailable, with another four partially offline, attributing these outages primarily to precautionary steps during the implementation of necessary security fixes. While specific services were not identified, officials confirmed that no major public-facing critical UK services had been compromised. A spokesperson emphasized that efforts to identify and address exposures within government systems are underway, involving collaboration with international partners and organisations like OpenAI, but stressed that there is no evidence of any breaches at this stage.
The National Cyber Security Centre’s chief technology officer, Olly Whitehouse, described the incident as “unprecedented” and predicted its global impact. He reassured that there are “no indications” of successful hacks related to this event. Meanwhile, positive reports indicate that affected parties are heeding official guidance to mitigate risks. Cyber-security experts and industry figures have also voiced concerns about the urgency and scale of response required. Rory Hopcraft, a cyber-security lecturer, highlighted the government’s responsibility to maintain robust infrastructure, urging it to lead by example. On the ground, some businesses like Dean Presley’s garage in South Wales have experienced operational difficulties directly linked to the fallout, such as an inability to process MOT paperwork electronically.
PHP, short for PHP: Hypertext Preprocessor, is a server-side scripting language developed in the early 1990s. It powers dynamic web pages by processing data on web servers and generating the content users see. Its widespread use includes platforms like Wikipedia, numerous online stores, and WordPress, which supports many websites worldwide. Popular PHP frameworks such as Laravel, Symfony, and Drupal also rely on this language. Cyber-security firm Wiz, which helped uncover the flaws known as “php2shell,” noted that PHP supports approximately 70% of the web and that the vulnerabilities exist across multiple earlier versions of the language.
The PHP Foundation warned that these vulnerabilities could allow unauthenticated attackers to remotely execute malicious code on affected servers. In anticipation of potential exploits, several large organisations reported a surge in hacking attempts. Matthew Prince, CEO of Cloudflare, described seeing “thousands” of attack attempts within hours before the vulnerability was publicly disclosed, escalating to millions shortly after. Similarly, Amazon reported attempted exploits but confirmed that its own systems remained fully operational.
Although many websites initially went offline on Wednesday following the announcement, some—like a Dutch cyber-security agency, Finland’s government sites, and parts of Wikipedia—had returned to normal by Thursday. Nonetheless, ongoing efforts to assess and patch internet infrastructure led to continued downtime for certain platforms worldwide, including telecommunications company Orange, which temporarily restricted access to some global services. Experts scanning vulnerable servers observed patch implementation was proceeding more slowly than desired. Matt Hull, vice president of cyber intelligence and response at NCC Group, pointed out the narrowing response window, explaining that where attackers historically took weeks to exploit vulnerabilities, the timeframe has now shrunk to hours or days. He also acknowledged the toll this emergency is taking on security teams, advocating for adequate rest and shared effort to maintain resilience, noting that it relies as much on people as it does on technology
Read the full article from The BBC here: Read More
Auto Amazon Links: No products found.