Organisations around the world have been scrambling to fix a critical security flaw in the programming language PHP used by the majority of websites.
asserted
Organisations → scramble → websites
Downing Street on Thursday said no large UK public-facing critical services have been affected, but some “limited” Government websites have gone dark while issues are resolved.
asserted
issues → say → Thursday
National Cyber Security Centre (NCSC) experts are working with OpenAI, whose technology was used to discover the vulnerabilities, and partners around the globe to address potential problems, a No 10 spokeswoman said.
asserted
spokeswoman → work → problems
Tech minister Baroness Lloyd of Effra told the House of Lords: “The information I have is that 32 Government services are unavailable and four are partially unavailable.”
asserted
four → tell → Lords
She said that “has largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied”.
asserted
updates → say → systems
The Downing Street spokeswoman told reporters: “Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue.
asserted
experts → tell → issue
“No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out.
uncertain
work → face → exercise
“But this does not mean they were hacked, and work continues to resolve any issues.”
asserted
work → mean → issues
The spokeswoman said it was not “standard practice” to provide a list of Government services that were affected.
asserted
that → say → services
It came after cybersecurity chiefs warned UK organisations on Wednesday that a “critical security issue” had been discovered in PHP, which is used by almost 70% of websites according cybersecurity firm Cloudflare.
asserted
which → come → Cloudflare
Lady Lloyd said the NCSC was briefed by OpenAI on the vulnerability “last week” and “the Government acted proactively ahead of public disclosure”.
asserted
Government → say → disclosure
Organisations have been urged by the NCSC to update to a new, fixed version of the PHP software – or consider taking their websites offline if they cannot be upgraded immediately.
asserted
they → urge → websites
The No 10 spokeswoman said: “Organisations of all sizes should follow NCSC guidance to protect their system.”
asserted
Organisations → say → system
The NCSC said the scale of the issue was “unprecedented” and warned it would likely not be the last.
Chief technology officer Ollie Whitehouse said the centre had been carrying out a “co-ordinated disclosure process” warning organisations of the vulnerability after it was identified months ago.
asserted
it → say → vulnerability
“We’re in an era now of digital dependency, coupled with heightened cyber threat, coupled with kind of increasing capability, which means all organisations are going to likely have to revisit their risk assumptions and work out how they are able to invest in technology to be able to meet the contemporary era,” he told BBC Radio 4’s World At One programme.
asserted
he → ’re → programme
Earlier, a minister said the security of next week’s Budget has not been compromised.
asserted
security → say → Budget
Scottish Secretary Douglas Alexander was asked whether the issues identified with PHP could result in major Budget leaks because the Office for Budget Responsibility (OBR) had to take down its website.
uncertain
Office → ask → website
Mr Alexander told Times Radio on Thursday morning: “No, I’ve had no indication whatsoever that there’s any problem in terms of a breach of Budget security.
“Indeed John Healey, who I was with yesterday in Scotland, as I understand it initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer.
asserted
he → tell → summer
Last year, the OBR’s budget analysis was mistakenly published online ahead of then-chancellor Rachel Reeves’s statement to the Commons, allowing for early access to market sensitive information.
asserted
analysis → publish → information
The PHP security issue identified could allow attackers to remotely control any web servers running PHP, which underpins popular platforms such as WordPress and Magento.
uncertain
which → identify → WordPress
Many attempts at exploiting the vulnerability were spotted within hours of it being announced, according to Amazon and Cloudfare.
uncertain
it → exploit → Amazon
In an update published on the Amazon Web Services security blog, the company said its threat intelligence team found the flaw was “now being broadly exploited in the wild”.
asserted
flaw → publish → wild
Cloudfare chief executive Matthew Prince said on Thursday the firm spotted hundreds of thousands of hacking attempts within two hours of the announcement, with millions ongoing.
asserted
millions → say → announcement
PHP developers had reportedly planned a security update on Thursday, but the release was brought forward after details of its work to address the vulnerabilities leaked online.
uncertain
details → plan → vulnerabilities
Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security (SCCS), said “the cat was let out of the bag rather earlier than it was supposed to have been”.
“There’s always a window between the flaw being publicly known about and it being patched so that the attackers can’t successfully get in,” Professor Woodward told BBC Radio 4’s Today programme.
asserted
Woodward → visit → programme
“And what happened, unfortunately, the day before the patch was out, somebody let the cat out of the bag.
asserted
somebody → happen → bag
“There was an initial version of the patch that was released, and so it was very easy to compare the original with the patched version and see which bit of code you needed to go and exploit.”
asserted
you → be → code
The Wall Street Journal had reported that the flaw was discovered in August by Ryan Austin, a researcher at the cybersecurity company Calif, using an advanced AI model developed by OpenAI.
asserted
flaw → report → OpenAI
Professor Woodward explained the vulnerability had in fact already been identified by human researchers in 2024, but it was then believed exploiting this security flaw would be “too complicated”, and nothing was done.
“People have been scrambling away, saying, ‘Well, actually, yes, you can exploit it, and we now need to patch it’,” he said.
asserted
he → explain → it
“And the patch came out yesterday afternoon – luckily, the PHP Foundation issued one, so that’s why everybody’s scrambling to make sure that that’s in place.”
asserted
’s → come → place
The Aporia
