PHP Flaws Spark Global Cyber Scramble as Governments Hunt for Exposure
The UK government says it is working to identify any potential exposure in its online services after critical cyber-security flaws were identified in the PHP programming language, which underpins a significant number of the world's websites. Governments and some of the world's biggest companies, including Amazon, are rushing to protect systems that use PHP before hackers can exploit the flaws.
The flaws were first discovered by artificial intelligence, after which governments urged anyone who uses PHP to address them. A UK government spokesperson urged all organisations, private and public, large and small, to follow guidance to protect their systems.
The UK's National Cyber Security Centre, as well as its counterparts in the European Union and Australia, earlier urged those who use PHP to apply the fixes. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated, the centre said in a note.
PHP powers a vast number of platforms, including online shops, Wikipedia and WordPress, the content management system behind many websites such as blogs. When you visit a website like Wikipedia, PHP is the code that collects the information you need and presents it in a readable form.
Amazon announced on Wednesday that it had identified a PHP-to-shell exploitation attempt on 17 October. The company's security chief, CJ Moses, said an anonymous internet address attempted to target weaknesses in one of Amazon's decoy, or honeypot, systems. The use of an anonymous address suggests the activity was conducted by a threat actor, he said.
The PHP Foundation had intended to release its discovery later this month along with a complete fix, usually called a patch. But details of the flaw were leaked on social media on Tuesday. Moses said that in subsequent attacks on Amazon on 21 October, the payloads and anonymisation infrastructure varied, suggesting multiple actors were involved. The attacks occurred after the leak but before the embargo on the warning was lifted.
Amazon said it experienced attacks before the warning was made public. It added that it was unclear how the actors knew about the vulnerabilities. Moses added that the use of AI means more actors can act within hours or even minutes once technical details of a vulnerability are disclosed.
Anna-Maria Arabia, chief executive of the Australian Council on AI Strategy, said the PHP incident has demonstrated how quickly AI is changing the cybersecurity landscape, as what used to take months to expose a vulnerability is now taking days. She warned that threats would only become more commonplace as AI technology rapidly improves.
The PHP flaws went undetected for at least a decade. Cyber-security firm Wiz has estimated that roughly 70 percent of the internet is affected, though that figure could not be independently verified. OpenAI called the discovery one of the most impactful security issues in recent memory.
The Dutch cybersecurity agency went offline as a precaution, and Finland's government shut down its public web services. Wikipedia also took down parts of its website. This was in line with advice issued by governments, including the United States, to take websites down if the flaws could not immediately be fixed.
The US National Security Agency said the vulnerabilities often provide a direct path to a server's file system or database. In a later update it said attackers could steal sensitive data, disrupt services or move deeper into a network. These vulnerabilities are flaws in PHP itself, not in the hosted application or its configuration, the agency said.
Governments and companies are now racing both to identify their exposure and to apply the fixes. The early leak of the flaw's details, and attempted attacks before the warning was public, have made that race more urgent.
