Governments and firms rush to secure systems after serious PHP flaws disclosed
After critical security flaws were found in the PHP programming language, which underpins a large share of the world's websites, UK and other authorities are urging users to apply fixes. Amazon recorded several attack attempts before the warning embargo was lifted.
The UK government says it is checking its online services for possible exposure after critical security flaws were identified in PHP, a programming language used by a large number of the world's websites. Governments and major companies, including tech giant Amazon, are hurrying to protect their systems before hackers can exploit the weaknesses.
The flaws were first found by artificial intelligence, after which governments urged anyone using PHP to address them. The UK's National Cyber Security Centre (NCSC), together with counterparts in the EU and Australia, called on users to apply fixes. The NCSC said that where immediate remediation is not possible, organisations should consider taking the system offline until the risk is fully mitigated. A UK government spokesperson urged all organisations, private and public, large and small, to follow the guidance.
PHP powers many platforms, including online shops, Wikipedia and WordPress, the content management system behind numerous sites such as blogs.
Attacks on Amazon
Amazon said it identified a "PHP2Shell exploitation attempt" on 17 October. An anonymous internet address tried to target weaknesses in one of its decoy, or "honeypot", systems, according to security chief CJ Moses. He said the anonymity suggests a threat actor was behind it.
The PHP Foundation had planned to publish its discovery and a complete fix later this month, but details of the flaw leaked on social media on Tuesday. In further attacks on 21 October, the payloads and anonymisation infrastructure varied, which Moses said suggested multiple actors. They occurred after the leak but before the embargo was lifted. Moses added that AI means more actors can act within hours or even minutes of a vulnerability being disclosed.
Anna-Maria Arabia, CEO of the Australian Council on AI Strategy, told the BBC that what once took months to expose a vulnerability now takes days. The flaws went undetected for at least a decade. Cyber-security firm Wiz estimates that roughly 70% of the internet is affected, though the BBC could not independently verify the figure.
