GOVERNMENTS TAKE WEBSITES OFFLINE OVER PHP SECURITY FLAWS

The PHP Foundation released a patch on 21 October for two critical vulnerabilities in PHP, a programming language used by websites. Governments in the Netherlands, Denmark, France and Finland took at least some websites offline as a precaution. Canada also temporarily took government websites offline, according to Evan Solomon, its Minister of Artificial Intelligence and Digital Innovation, who announced the decision on X. PHP developers rated the vulnerabilities 9.2 out of 10 in an advisory published on Tuesday. The European Union Computer Emergency Response Team and the UK National Cyber Security Centre advised organisations unable to patch immediately to isolate public-facing applications or take them offline.

Cybersecurity firm watchTowr said the flaws affected PHP versions from PHP 5 onwards and could allow attackers to run code on affected servers. Attackers could use that access to alter websites or steal data, the firm said. A security researcher estimated that more than 1.3 million internet-connected hosts were likely affected. Wordfence warned that every WordPress site was vulnerable because WordPress runs on servers using PHP. WordPress said last year that it powered more than 40 per cent of the internet; Drupal also uses PHP.

Wordfence said site owners would need to arrange a manual PHP update because automatic updates could not install the fix. The US Cybersecurity and Infrastructure Security Agency urged organisations to apply the patch. The White House said it became aware of the issue on Friday. Tiffany Farriss, interim chief executive of the Drupal Association, said: “This issue impacts the majority of the Internet.” Solomon also urged operators of websites using PHP to update as soon as possible.