Governments and cyber-security agencies around the world urged website operators to install an emergency fix or consider taking their platforms offline after a cyber-security alert involving PHP disrupted services globally.
PHP is a programming language used internationally since the 2000s to build websites. The vulnerabilities affected software used across online services, including gaming platforms, government portals and online forums.
Risk of server takeover
A flaw could allow attackers to take control of affected web servers without authentication and steal sensitive data, leaving everything built on PHP exposed.
Some experts warned that poorly maintained websites could face greater risk, particularly those operated by smaller organisations with limited security resources. Website owners are being urged to secure their websites with the latest version of PHP.
Wikimedia, the organisation behind Wikipedia, took down a number of its systems as a precautionary measure. Amazon said it had been targeted in multiple attempts days before the public disclosure of the PHP issue, although it was unknown how potential attackers knew about the vulnerability.
Patches released
PHP platform developers rolled out patches on Wednesday to fix vulnerabilities that had been present in their software for years. Paul Spain said the patch was a small, routine fix for most technology teams.
The vulnerabilities were found by researchers at the security firms Calif and Wiz, who used advanced AI tools to analyse code and find flaws faster than humans or older systems. OpenAI said it had released a programme to check whether the PHP platform is secure.
Salil Kanhere, a cyber-security researcher from UNSW Sydney, said more attempts to exploit the flaws were likely in the coming weeks because their technical details were being made public.
Source: BBC News