UK working to identify exposure after global cyber-security warning
BBC News reports on the UK government's efforts to address vulnerabilities in the PHP programming language, which underpins many websites worldwide. These flaws have prompted a global scramble for cyber-security.
The UK government is actively identifying and patching potential exposures in its online services. The vulnerabilities were initially discovered by AI, leading to urgent calls for websites to address them.
Governments and major companies, such as Amazon, raced to protect their systems before hackers could exploit the flaws. Amazon reported multiple attempts to target its systems before the warning embargo was lifted, with the company unsure of the attackers' identities.
A UK government spokesperson urged all organizations, public and private, to follow security guidance. The UK's National Cyber Security Centre (NCSC) also advised those using PHP to apply the necessary fixes, suggesting that systems be taken offline if immediate remediation is impossible.
Amazon revealed an "PHP2Shell exploitation attempt" on October 17th, with subsequent attacks on the 21st indicating multiple actors. The use of AI technology has accelerated the discovery and exploitation of vulnerabilities, as demonstrated by the swiftness of the PHP incident.
The PHP flaws, undetected for over a decade, are estimated to affect roughly 70% of the internet. As a result, various countries and organizations have taken precautions, including the Dutch cybersecurity agency going offline and Finland shutting down its public web services, following advice from the US and others to temporarily take websites down if immediate fixes are not feasible.
PHP released software patches on October 21st to address these vulnerabilities.