Race to update services' computer systems after cyber-security flaw found
Websites were taken offline after the developers of programming language PHP said "critical vulnerabilities" had been discovered.
Organisations and businesses are still working to update their systems after cyber-security flaws were discovered in a widely-used programming language called PHP. On Wednesday and Thursday, websites worldwide went offline due to the developers of PHP finding critical vulnerabilities in the back-end language used extensively in web development for decades.
Researchers warned that these severe flaws could leave millions of sites using PHP susceptible to potential hacks if not patched. The UK government was among those to take some sites offline as a precaution, with Downing Street announcing that some limited government services may be unavailable while security work is carried out.
The government did not disclose which services were affected, but assured that no large UK public-facing critical services had been impacted. The National Cyber Security Centre (NCSC) described the situation as unprecedented, stating that no indications of successful breaches by hackers have been found. PHP is the cyber equivalent of an unexploded bomb, according to cyber-security lecturer Rory Hopcraft, who emphasized that the government should ensure its own infrastructure is up-to-date.
Dean Presley, a garage owner from Chepstow, South Wales, reported that his computer system had been down since Wednesday, causing delays in processing MOTs online. PHP, a programming language that runs on web servers behind the scenes of websites, is responsible for collecting data and presenting it in a readable format. It has been used in various platforms, including Wikipedia, online shops, and WordPress, powering around 70% of the world's websites.
The security flaws, dubbed 'php2shell,' affect many past versions of PHP, potentially allowing unauthenticated attackers to remotely execute code on servers running PHP. Some large organizations reported high volumes of attempted breaches following the announcement. While disruptions continue, most websites have since returned to normal operation.
Written by urgent.news from BBC Technology's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
