A Huge Flaw in PHP Language Leads to Shutdown of Websites Around the World

IBL News | New York

Websites worldwide went dark after experts found a serious vulnerability in PHP, a programming language that powers much of the World Wide Web.

As bad actors could exploit a vulnerability in PHP, which powers 70% of sites, governments and corporations carried out precautionary takedowns. Site administrators scrambled to patch that critical weakness, which became public on Tuesday.

National security agencies in Washington and London issued warnings that millions of websites will need fixing.

The US National Security Agency told all organizations using PHP to take their systems offline if they couldn’t patch them immediately. It said the vulnerability could “provide a direct path to the server’s file system or database”.

The UK’s National Cyber Security Center gave similar advice, telling organizations to check for “backdoors installed by an attacker”.

Infrastructure experts reported that Russian state actors or organized criminals were trying to exploit the flaw to carry out cyber-attacks.

WordPress, one of the most common website systems, uses PHP, as do Wikipedia, Slack, and much of Facebook. The Wikimedia Foundation said it took down several systems on Wednesday as a precaution until it could patch them.

Because the fix is now public and AI tools can reverse-engineer the bug with little effort, experts said malicious hackers jumped to get ahead of the updates.

Prof Alan Woodward, a cybersecurity expert at Surrey University, said: “It was very surprising and troubling because of the extent to which PHP was used around the world. PHP issued a patch very quickly. The big thing is for everyone using it to get that in to make sure their systems are safe.

“The troubling part is there is going to be a long tail of websites that may not be maintained as well, and they are going to remain vulnerable, which means we may see weeks and months of ongoing attacks. For the big juicy targets, I hope to goodness they are being patched quickly.”