- Published
The Finnish government, Edinburgh council and the BBC are among those to have taken down sites and pages down ahead of a software update to a programming language which underpins many online services.
asserted
which → publish → services
Two critical vulnerabilities with the PHP programming language, which is widely used across the internet, have been identified - with a fix issued for them on Wednesday afternoon.
Multiple cyber-security agencies have urged organisations to rapidly adopt the updates, or consider taking their websites offline.
asserted
agencies → use → websites
Finland has temporarily shut down the government's public web services, while the Netherlands' cyber-security agency said it was taking its own website offline due to the vulnerabilities.
asserted
it → shut → vulnerabilities
Meanwhile, Edinburgh council's website has become inaccessible, as well as the online homes for several BBC programmes including Doctor Who and The Traitors.
asserted
website → become → Who
They have not confirmed a link to PHP - BBC News has approached them for comment.
asserted
News → confirm → comment
The Netherlands' National Institute for Public Health and the Environment, an agency of the Dutch government, has taken down its website.
asserted
Institute → take → website
Similarly the website of the Tweede Kamer, the lower house of the nation's parliament, has become inaccessible.
asserted
website → become → parliament
The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia have urged those who use PHP to apply the fixes.
asserted
who → urge → fixes
"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC said in a note, external.
asserted
NCSC → consider → note
Japan's national cyber-security office and EU cyber-security officials have issued a similar warning, external.
asserted
office → issue → warning
It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," cyber-security company Huntress said.
asserted
Huntress → power → hood
Cyber-security expert Don Smith, from the Sophos Counter Threat Unit, told the BBC this would "likely be a priority target" for hackers.
asserted
this → tell → hackers
The immediate challenge was not simply installing a patch to fix the issue, but finding and managing every instance where PHP was running
asserted
PHP → instal → instance
, he said.
asserted
he → say → ?
"The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it," he said.
asserted
he → sit → it
He said it was crucial that organisations looked out for signs that an attacker "might have already have gained a foothold".
uncertain
attacker → say → foothold
'Early attacks emerging'
asserted
attacks → emerge → ?
The European Union Computer Emergency Response Team (CERT-EU) said the risk scores given to the vulnerabilities "indicate the potential for unauthenticated remote code execution".
asserted
scores → say → execution
Such a cyber-attack could potentially allow hackers to install malware and take down websites.
uncertain
hackers → allow → websites
Dane Knecht, chief technology officer at internet infrastructure firm Cloudflare, said he was, external "seeing early attacks emerging and are updating mitigations as new vectors show up".
asserted
vectors → say → mitigations
The NCSC said once organisations have installed the update, they should "continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP".
uncertain
that → say → PHP
It is not yet clear which versions of the programming language are affected, but CERT-EU said it could affect all versions of it dating back to PHP 5 onwards - which launched in 2004.
uncertain
which → affect → 2004
PHP was created for web development.
asserted
PHP → create → development
It is used on servers to implement what you see when you visit websites.
asserted
you → use → websites
Not all websites use it, but it nonetheless powers a large portion of the internet.
asserted
it → use → internet
The Aporia
