Websites taken offline worldwide as operators rush to patch PHP flaws
Banks, airlines, railways and government agencies from Japan to Finland have temporarily shut down online services while they patch two critical vulnerabilities in PHP, one of the most widely used programming languages on the web. At the same time, attempts to exploit the flaws have surged into the millions.
The vulnerabilities had been in the software for years before they were uncovered with the help of AI, Reuters reports. The PHP developers released emergency fixes on Wednesday and urged users to “update immediately”. By then, details of the flaws had already become public.
“Details of these flaws became public before fixes were ready, and attacks have since been reported. So companies are racing to update against attackers who can use AI to exploit them,” said Madeline Lawrence, co-founder of Belgian cybersecurity company Aikido Security, according to Reuters.
According to Cloudflare CEO Matthew Prince, the company saw thousands of exploit attempts across its network in the ten hours before the flaws were announced. That rose to tens of thousands in the first 45 minutes after the announcement and to hundreds of thousands within two hours. By late Wednesday, the attempts were in the millions.
In Japan, Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway suspended some internet services, as did the Ministry of Finance and the National Tax Agency. French telecoms group Orange temporarily blocked access to some PHP-based websites and applications across several subsidiaries. In Finland, the state IT services provider Valtori shut down government web services on Wednesday and installed patches overnight. Valtori says the outages were precautionary and that it is not aware of any active exploitation of the flaws.
In Asia, governments ordered security inspections. China’s industry ministry urged organisations to upgrade to the latest version of PHP and change passwords and keys where necessary, and South Korea raised its cybersecurity alert level for the private sector.
