UK government services offline as PHP cyber flaw triggers global patch race
Organisations worldwide are patching systems after critical flaws were found in PHP, the language behind most websites, and the UK government took some services offline as a precaution.
At a glance
- Critical flaws in PHP, which powers most websites, prompted sites and UK government services to go offline as a precaution.
- Tech minister Baroness Lloyd of Effra said 32 government services were unavailable and four partially unavailable.
- No successful attacks have been reported, but Cloudflare said exploitation attempts rose to millions after the flaws were announced.
Organisations around the world are still racing to patch their systems after critical vulnerabilities were disclosed in PHP, a programming language used across much of the web, and the UK government was among those that took sites offline as a precaution.
Websites went down on Wednesday and Thursday. Tech minister Baroness Lloyd of Effra told the House of Lords on Thursday that 32 government services were unavailable and four partially unavailable, a situation she said "largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied". Downing Street said "some" limited government services "may be offline". The government said no large UK public-facing critical services had been affected, and a spokesperson said work had already taken place to identify and fix potential exposures, with experts continuing to work closely with OpenAI and international partners.
Researchers warned the "severe" flaws could expose millions of sites to potential hacks if left unpatched. No successful attacks have been reported so far, but experts say any impact may take months to become fully apparent.
What is PHP and what is the flaw?
PHP – short for PHP: Hypertext Preprocessor – runs on a web server behind the scenes, collecting data and turning it into the pages users read. Developed in the early 1990s, it still powers platforms including Wikipedia, online shops and WordPress, as well as frameworks such as Laravel, Symfony and Drupal. Security firm Wiz, which helped uncover the flaws, says PHP powers 70% of the world's websites, and that the vulnerabilities, now called "php2shell", are inherent in the language and affect many past versions of it. The PHP Foundation warned that under the right conditions an unauthenticated attacker could remotely execute code on servers running PHP.
Exploitation attempts rise sharply
Cloudflare boss Matthew Prince said the company saw "thousands" of attempts to exploit the flaws in the 10 hours before they were announced, rising to tens of thousands within 45 minutes, hundreds of thousands within two hours and "millions now". Amazon said it also saw attempts but that its websites were operating normally. In France, telecoms company Orange said it had suspended access to certain services globally while deploying fixes. The website of a Dutch cyber-security agency, Finland's government and parts of Wikipedia went offline and had returned to normal by Thursday.
'Unprecedented'
Olly Whitehouse, chief technology officer of the National Cyber Security Centre, called the event "unprecedented" and said it would be "universally felt", but that there were "no indications" of successful breaches by hackers. Dean Presley, who runs a garage in Chepstow, South Wales, said his system had been down since Wednesday morning, leaving him unable to process MOT paperwork or certificates and forcing him to use paper documents, which delayed customers. Matt Hull of NCC Group said the "window to respond has shrunk dramatically", adding that security professionals may already be facing burnout days into the incident.
Source: BBC Technology.
Questions and answers
- What is the PHP cyber-security flaw?
- Researchers found critical vulnerabilities, now called "php2shell", in PHP, a language used across much of the web. Wiz, which helped uncover them, says the flaws are inherent in the language itself and affect many past versions.
- Were UK government services affected?
- Yes. Tech minister Baroness Lloyd of Effra told the House of Lords that 32 government services were unavailable and four partially unavailable, largely due to precautionary measures. No large public-facing critical services were affected.
- Have there been any successful attacks?
- No successful breaches have been reported so far, according to the NCSC. Cloudflare reported rising volumes of attempted exploitation, and experts say any impact may take months to become apparent.
