Government websites in Europe and elsewhere have gone offline after news of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems.
asserted
news → go → systems
Developers of the PHP programming language on Wednesday released urgent new fixes, saying all users were “encouraged to update immediately”.
asserted
users → release → fixes
Recommended Stories
list of 3 items- list 1 of 3Judge orders Meta to pay $25bn in fines for Facebook privacy violations
- list 2 of 3Meta faces Australian lawsuit over alleged social media harm to children
- list 3 of 3‘Facebook’s wrongdoing’: Why has Meta been fined $25bn in New Mexico?
PHP runs on the servers that host websites, building pages behind the scenes before they reach a visitor’s browser.
asserted
they → order → browser
Most people never see it, but it powers everything from blogs to online shops and government portals.
asserted
it → see → shops
The vulnerabilities, which had been lurking in the software for years, were uncovered with the help of artificial intelligence.
asserted
which → lurk → intelligence
Details about them leaked online on Tuesday before fixes were available, forcing PHP to rush them out.
asserted
fixes → leak → them
Experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of the updates.
asserted
hackers → say → updates
Andrew Cullen, a lecturer on AI and cybersecurity at the University of Melbourne, said many devices in the world are connected to one piece of foundational software, which is where the bug was found.
asserted
bug → say → software
The vulnerability allows a hacker to run code on a website, meaning they could change the website or force it to release personal information collected in a database, Cullen told Al Jazeera.
uncertain
Cullen → allow → Jazeera
Both flaws stem from how PHP handles fatal errors, such as running out of memory.
asserted
PHP → stem → memory
Because the problem sits in PHP itself, even the simplest website running an affected version can be vulnerable, and attackers could read passwords and other credentials from a server’s memory, the cloud security company Wiz said.
uncertain
company → sit → memory
Both flaws scored 9.2 out of 10 on the industry’s standard severity scale, placing them in the “critical” category.
asserted
flaws → score → category
The two flaws, nicknamed PHP2Shell, were found independently by two cybersecurity companies using AI.
asserted
flaws → nickname → AI
Calif, working with OpenAI, reported the first on August 11.
asserted
Calif → work → August
Wiz, which is owned by Google, reported the second on August 24.
asserted
which → own → August
The vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to take advantage of, Wiz said in a statement.
Calif and Wiz said they had coordinated with each other, the PHP team and OpenAI before making the vulnerabilities public.
asserted
vulnerabilities → remain → other
However, Amazon security chief CJ Moses said his security team detected an attempt to exploit the vulnerabilities on October 17, four days before the public disclosure.
asserted
team → say → disclosure
Moses said it was unclear how the hacker learned of the flaws while Calif’s and Wiz’s reports were still under embargo.
uncertain
reports → say → embargo
Security researchers usually keep details of flaws secret until a fix is ready, so attackers cannot use them in the meantime.
asserted
attackers → keep → meantime
Who can potentially be affected?
asserted
Who → affect → ?
PHP, a language that dates back to the early 1990s and initially stood for Personal Home Page, underpins huge parts of the public-facing web and is baked into WordPress, Drupal, Joomla and Magento sites, meaning any critical vulnerability potentially has enormous knock-on consequences.
asserted
vulnerability → date → consequences
Calif, Wiz and the web infrastructure company Cloudflare said the flaws affect PHP 5.4 and later versions, more than a decade of releases.
asserted
flaws → say → releases
Cullen said the vulnerability was “really unprecedented”, noting that PHP powers more than 70 percent of websites globally, although sites that have been updated are protected.
asserted
that → say → websites
“There is a real risk to the kind of shared digital infrastructure that we all rely on,” Cullen told Al Jazeera.
asserted
Cullen → be → Jazeera
“There is concern in the cybersecurity community about what the blast radius for this will be, even though the developers of PHP have been very quick to try and develop patches for it.”
asserted
developers → be → it
Cullen added that while AI was getting better at cybersecurity, it was also getting better at being a hacker.
asserted
it → add → cybersecurity
“This means that we are developing systems … that are making the internet safer by helping to fix bugs, but we’re also making it riskier by discovering bugs and creating bugs they’ll be able to hack,” he said.
asserted
he → mean → bugs
In the Netherlands, the Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities.
asserted
it → go → vulnerabilities
Several organisations followed the example and took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national football association KNVB, the websites for the country’s five largest political parties and several hospital websites.
asserted
organisations → follow → parties
Dutch Prime Minister Rob Jetten said he was closely monitoring the situation.
asserted
he → say → situation
Disruptions were even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline “as a precautionary measure”.
asserted
services → say → measure
France’s Ministry of the Interior said it had placed all of its websites into preventive maintenance.
asserted
it → say → maintenance
Belgium’s Federal Public Service Foreign Affairs, Foreign Trade and Development Cooperation said it had temporarily taken its websites offline after reports of cyberattacks exploiting the PHP vulnerabilities although the country’s cybersecurity centre said it had not recorded any attacks on Belgian websites.
asserted
it → say → websites
South Korea’s government raised its private-sector cybersecurity alert level and activated emergency response measures.
asserted
government → raise → measures
It issued security guidance to about 28,000 companies with registered chief information security officers and 5,900 members of a government information-sharing network as well as operators of critical infrastructure, web-hosting firms and data centres.
asserted
It → issue → infrastructure
The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched while the Internet Archive, the sprawling online library, said it also briefly went offline to deal with the issue.
uncertain
it → say → issue
The Aporia
