Organisations and businesses are still scrambling to update their systems after cyber-security flaws were revealed in a widely-used programming language, PHP. Websites around the world were taken offline on Wednesday and Thursday after the developers of PHP said "critical vulnerabilities" were found in the back-end language, used in web development for decades. Researchers warned the "severe" flaws could expose millions of sites using it to potential hacks if left unpatched - and the UK government was among those to take some sites offline as a precaution.
There have been no successful attacks reported so far, but experts say any impact may take time - even months - to become fully apparent. Downing Street said on Thursday "some" limited government services "may be offline" while security work was being carried out. "The information I have is that 32 Government services are unavailable and four are partially unavailable," tech minister Baroness Lloyd of Effra told the House of Lords.
She attributed this to having "largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied". The government did not specify which services were taken offline - but it said no large UK public-facing critical services had been affected. A spokesperson said work had already taken place across government to "identify and fix potential exposures to our systems and our experts are continuing to work closely with both OpenAI and international partners on this issue".
"But this does not mean they were hacked, and work continues to resolve any issues," they added. Olly Whitehouse, chief technology officer of the National Cyber Security Centre (NCSC), called the event "unprecedented". "It will be universally felt, I suspect," he told BBC Radio 4's World At One.
But he said there were "no indications" of any successful breaches by hackers. He said the NCSC was "starting to see positive confirmation" that advice sent to those affected, external had been received and was being acted on. Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb What is PHP and why did it spark a global cyber-security scramble?
Cyber-security lecturer Rory Hopcraft told the BBC the government needed to make sure that its own infrastructure was up-to-date. "Hacking has been around for many years," he said. "The government are the ones who set the rules for other organisations... they just need to effectively be practising what they're preaching at this point." Dean Presley, who has a garage in Chepstow, South Wales, told BBC Your Voice he had been unable to properly process MOTs online.
Extract — continue reading at the source.
