Websites go offline as critical PHP security fixes roll out

Websites and public services went offline Wednesday as organisations raced to install fixes for two critical flaws in PHP, a programming language used across much of the internet. Cybersecurity authorities in Britain and Europe urged operators that could not apply the updates quickly to consider taking affected systems offline.

The PHP security team released patches Wednesday. PHP runs on web servers and is used by 69% of websites, according to W3Techs, a service that surveys web technology.

Finland temporarily shut down government public web services, while the Netherlands’ cybersecurity agency said it was taking its own website offline because of the vulnerabilities, the BBC reported. The website of the Dutch National Institute for Public Health and the Environment was also taken down, and the website of the Tweede Kamer, the lower house of parliament, became inaccessible.

NBC News reported that the bookmarking service Pinboard, parts of Wikipedia and the forums 4Chan and Something Awful went offline while awaiting a fix. Japanese websites, including systems for daycare centres and video games, also went offline voluntarily, NBC News reported, citing Japanese technology site ITmedia.

Edinburgh council’s website and pages for several BBC programmes, including Doctor Who and The Traitors, were inaccessible, according to the BBC. Neither the council nor the BBC had confirmed that those outages were linked to PHP, the broadcaster said.

The United Kingdom’s National Cyber Security Centre advised organisations to install the fixes. “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” it said. The EU’s computer emergency response team, CERT-EU, advised organisations to consider isolating internet-facing applications from public networks until a fix was available. Cybersecurity authorities in Australia and Japan also issued warnings, the BBC reported.

Researchers at the cybersecurity firms Calif and Wiz discovered the flaws using OpenAI technology, according to the BBC. The firms said the vulnerabilities had gone undetected for more than a decade. OpenAI said the discovery came through a programme that gives cybersecurity companies access to ChatGPT models designed to find software flaws, and that the flaws were brought to PHP’s attention before hackers exploited them more severely.

“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said. Wiz described them as the “most severe vulnerabilities ever discovered” by AI.

The extent of any exploitation remained unclear. Cybersecurity platform Patchstack said it had received “reports of active exploitation,” NBC News reported. Cloudflare technology chief Dane Knecht wrote that the company was “seeing early attacks emerging and are updating mitigations as new vectors show up.”

CERT-EU said the flaws’ risk scores indicated the potential for attackers to run code remotely without authentication. It said versions dating back to PHP 5, released in 2004, could be affected, although the scope was not yet clear. Fixes were issued only for the latest versions, the BBC reported, with users of PHP 8.1 or older urged to upgrade.

Finding every place PHP is running may be as important as installing the fix, Sophos cybersecurity expert Don Smith told the BBC. Organisations should also look for signs an attacker may already have gained access, he said.