The UK government is currently working to identify any potential exposure in its online services following a global warning about critical cyber-security flaws in the PHP programming language. This code underpins a significant portion of the world’s websites, prompting urgent action from officials and major technology firms alike.
Global Scramble to Patch Systems
Governments and large corporations, including Amazon, are rushing to protect systems that rely on PHP before malicious actors can exploit the identified weaknesses. The vulnerabilities were initially discovered with the assistance of artificial intelligence, leading authorities to urge all PHP users to apply fixes immediately.
Amazon reported multiple attempts to target its systems, stating that these incidents occurred before the embargo on the warning was lifted. The company noted that it remains unclear how the threat actors became aware of the vulnerabilities so quickly. A security chief at Amazon, CJ Moses, described one incident as a “PHP2Shell exploitation attempt” involving an anonymous internet address targeting a decoy system.
Subsequent attacks on Amazon on October 21 involved varied payloads and anonymization methods, suggesting involvement from multiple distinct groups. Moses highlighted that the use of AI allows more actors to act within hours or even minutes once technical details of a vulnerability are disclosed.
UK Government and NCSC Guidance
A UK government spokesperson urged all organizations, whether private or public and regardless of size, to follow official guidance to protect their systems. The UK’s National Cyber Security Centre (NCSC), along with counterparts in the EU and Australia, advised those using PHP to apply the necessary fixes.
The NCSC stated that where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated. This advice led to the temporary shutdown of several high-profile websites. The Office for Budget Responsibility took its website offline in view of the critical security issues. Edinburgh and Oxford council websites also went offline on Wednesday but have since been restored.
The Dutch cybersecurity agency went offline as a precaution, and Finland shut down its public web services. Wikipedia also took down parts of its website. The BBC confirmed that websites for several of its programs, including Doctor Who and The Traitors, were currently inaccessible, though a direct link to PHP has not been officially confirmed by the broadcaster.
Scale and Impact of the Vulnerability
PHP powers a vast number of platforms, including online shops, Wikipedia, and WordPress. When users visit these sites, PHP is the code that collects information and presents it in a readable format. Surrey Centre for Cyber Security Professor Alan Woodward said the flaw affects approximately 30 million websites.
Woodward explained that the nature of the flaw allows an attacker to get their own code onto a webserver and run it. “They can steal data, they can go to other parts of your network,” he said. “All sort of things like that – even plant a backdoor to get in later on, so it’s pretty serious.” Cyber-security firm Wiz has estimated that roughly 70% of the internet is affected, though this figure has not been independently verified by the BBC.
Cyber-security researcher Ryan Austin, who has studied PHP security for 20 years, discovered the flaw. He described it as the most serious vulnerability he has ever found, noting that he would not have been able to identify it without AI. Austin compared PHP to the old wiring in a house that keeps it running but is often overlooked.
The US National Security Agency warned that the vulnerabilities often provide a direct path to a server’s file system or database. This could allow attackers to steal sensitive data, disrupt services, or move deeper into a network. OpenAI called the discovery one of the most impactful security issues in recent memory.
Anna-Maria Arabia, CEO of the Australian Council on AI Strategy, told the BBC that the incident demonstrated how quickly AI is changing the cybersecurity landscape. She warned that threats would become more commonplace as AI technology improves, noting that what used to take months to expose a vulnerability is now taking days.
Source: BBC
