Websites around the globe have gone dark after a serious vulnerability was found in a computer language used to build much of the world wide web. Belgian, Dutch, Finnish, French and German sites were among those that governments took down temporarily as they scrambled to patch the critical weakness in PHP, a language used by almost 70% of websites. The vulnerability in the programming language, which became public on Tuesday, sparked warnings from national security agencies in Washington and London.
It means millions of websites will need to be fixed. One internet infrastructure expert said Russian state actors or organised criminals could exploit the flaw to carry out cyber-attacks. Wordpress, one of the most common website systems, uses PHP, as does Wikipedia, the messaging software Slack and – at least historically – much of Facebook.
The Wikimedia Foundation said it had taken down several systems on Wednesday as a precautionary measure until they could be patched. The organisation behind the language issued a patch on Wednesday after researchers testing cyberdefences discovered the flaw. The US National Security Agency told all organisations using PHP to take their systems offline if they were unable to patch them immediately.
It said the vulnerability could “provide a direct path to the server’s file system or database”. The UK’s National Cyber Security Centre gave similar advice and told organisations to check for “backdoors installed by an attacker”. Prof Alan Woodward, a cybersecurity expert at Surrey University, said: “It was very surprising and troubling because of the extent to which PHP was used around the world.
PHP issued a patch very quickly. The big thing is for everyone using it to get that in to make sure their systems are safe. For the big juicy targets, I hope to goodness they are being patched quickly.” Woodward said there was a window of opportunity for bad actors.
The researcher who found the weakness, however, said they did not use models that were not available to the general public. In the UK, websites belonging to Edinburgh, Bristol and Oxford councils were taken offline. In France, local government websites including that of the Paris police prefecture went offline on Wednesday, as did in the Netherlands the national digital identity service, the website of the house of representatives and the site of the national cybersecurity centre.
Extract — continue reading at the source.
