Race to update services’ computer systems after cyber-security flaw found

Organisations and businesses worldwide are in a frantic race to update their critical computer systems following the revelation of severe cyber-security flaws in PHP, a programming language that underpins a vast majority of the internet. The discovery has sent shockwaves through the digital infrastructure, prompting widespread system shutdowns and a scramble for security patches. Developers of PHP, the ubiquitous back-end language used for decades in web development, confirmed the existence of "critical vulnerabilities" on Wednesday, leading to many websites being taken offline globally.

Researchers issued stark warnings about these "severe" flaws, highlighting the potential for millions of sites that rely on PHP to be exposed to malicious hacks if not promptly patched. The UK government was among the entities that proactively took some of its websites offline as a precautionary measure. While no successful attacks have been reported to date, cybersecurity experts caution that the full impact of these vulnerabilities may take considerable time, potentially months, to fully manifest.

Downing Street confirmed on Thursday that a limited number of government services were temporarily unavailable as security teams worked diligently to apply necessary updates and mitigations. Baroness Lloyd of Effra, the tech minister, informed the House of Lords that "32 Government services are unavailable and four are partially unavailable." She clarified that these disruptions were "largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied." The government has not disclosed the specific services affected but assured the public that no large, critical public-facing services had been compromised. A government spokesperson stated that extensive work had already been undertaken across all departments to "identify and fix potential exposures to our systems" and that experts were collaborating closely with OpenAI and international partners. They emphasized that these outages did not indicate successful hacks and that efforts to resolve any issues were ongoing.

Olly Whitehouse, Chief Technology Officer at the National Cyber Security Centre (NCSC), described the situation as "unprecedented," predicting that its impact would be "universally felt." However, he echoed the sentiment that there were "no indications" of any successful breaches by malicious actors. The NCSC has reported receiving "positive confirmation" that its advice, distributed to affected parties, had been received and was being acted upon.

Cyber-security lecturer Rory Hopcraft stressed the importance of the government ensuring its own infrastructure was robust and up-to-date, stating, "Hacking has been around for many years. The government are the ones who set the rules for other organisations… they just need to effectively be practising what they’re preaching at this point."

The real-world impact of these vulnerabilities is already being felt by businesses. Dean Presley, owner of a garage in Chepstow, South Wales, reported being unable to properly process MOTs online since Wednesday morning. While acknowledging past outages, he noted that this current disruption was unusually prolonged. "MOTs can be conducted and they’re legal but none of the paperwork and certificates can be printed and they’re not on the system," Presley explained, forcing him to revert to manual paper documentation, which has led to customer delays.

PHP, which stands for PHP: Hypertext Preprocessor, is a server-side scripting language that operates behind the scenes of websites, enabling the dynamic presentation of web content. It functions by processing data on the web server and converting it into a readable format for the user. Developed in the early 1990s to facilitate the creation of dynamic web pages and applications, PHP continues to power a significant portion of the internet today. Its widespread adoption is evident across numerous platforms, including Wikipedia, e-commerce sites, and WordPress, the content management system used by a vast number of websites. Popular PHP frameworks like Laravel, Symfony, and Drupal are also instrumental in building web applications.

Cyber-security firm Wiz, which played a role in uncovering the critical PHP vulnerabilities, estimates that PHP powers an astonishing 70% of the world’s websites. The flaws, now referred to as "php2shell," are reportedly inherent to the language itself, affecting numerous older versions. The PHP Foundation, the non-profit organization responsible for maintaining the language, has warned that under specific conditions, an unauthenticated attacker could execute code remotely on servers running vulnerable versions of PHP.

Evidence of the attempted exploitation is mounting. Matthew Prince, CEO of internet infrastructure company Cloudflare, reported on X (formerly Twitter) that Cloudflare detected "thousands" of attempts to exploit the PHP vulnerabilities across its network in the 10 hours preceding its public announcement. This number escalated rapidly, reaching tens of thousands within 45 minutes post-announcement and millions soon after. Amazon has also confirmed observing attempts to exploit these flaws, though its websites remained operational.

While the full ramifications of the PHP flaw are yet to be fully understood, the immediate disruption has been significant. Many websites were taken offline on Wednesday as organizations rushed to assess their systems. The websites of a Dutch cyber-security agency, the Finnish government, and parts of Wikipedia, which were temporarily taken offline, had resumed normal operations by Thursday. However, a number of other sites remained offline on Thursday as operators continued to check for any instances of PHP within their systems and apply necessary patches.

In France, telecommunications company Orange announced it had temporarily suspended access to certain global services while deploying security fixes. Independent cyber-security researchers, using scans to identify at-risk servers, have observed that while organizations are implementing patches, the global adoption rate is not as rapid as might be hoped.

Matt Hull, VP of Cyber Intelligence and Response at global cyber security company NCC Group, highlighted the shrinking window for response. "A few years ago, attackers might have taken weeks to exploit a vulnerability. Now, it can be days or hours." Hull also emphasized the immense pressure on developers and engineers dealing with this incident, noting the potential for significant burnout. He urged a collective effort to "make time to rest, share the workload and look after each other," concluding that "Resilience depends on people as much as technology." The race to secure the internet against these newly revealed vulnerabilities is far from over.