PHP flaw forces websites offline around the world

Websites around the world have been taken offline after a serious security flaw was found in PHP, the programming language used to build almost 70 per cent of websites.

Governments in Belgium, the Netherlands, Finland, France and Germany were among those that temporarily took sites down while they rushed to fix the weakness. In the UK, the websites of Edinburgh, Bristol and Oxford councils were taken offline.

Warnings from London and Washington

The vulnerability became public on Tuesday, and the organisation behind PHP released a fix on Wednesday. Security agencies on both sides of the Atlantic issued urgent warnings, saying millions of websites would need to be updated.

The US National Security Agency told organisations to take their systems offline if they could not patch them immediately, warning that the flaw could "provide a direct path to the server's file system or database". The UK's National Cyber Security Centre gave similar advice and told organisations to check for "backdoors installed by an attacker".

PHP powers WordPress, one of the most widely used website systems, as well as Wikipedia and the messaging service Slack. The Wikimedia Foundation said it had taken several systems down as a precaution until they could be patched.

A race against attackers

Because the fix is now public, and artificial intelligence tools can work out how the bug operates with little effort, experts warned of a wave of attacks as hackers try to get ahead of the updates.

Professor Alan Woodward, a cybersecurity expert at the University of Surrey, said: "It was very surprising and troubling because of the extent to which PHP was used around the world. PHP issued a patch very quickly. The big thing is for everyone using it to get that in to make sure their systems are safe."

"The troubling part is there is going to be a long tail of websites who may not be maintained as well, and they are going to remain vulnerable, which means we may see weeks and months of ongoing attacks."

The internet infrastructure expert Michał Woźniak warned that criminal gangs and Russian state actors could use vulnerable sites as a base for other attacks. "There's going to be a lot of automatic exploitation of this," he said.

Found with the help of AI

The flaw had sat unnoticed in PHP's code for more than a decade. Several companies said they had found it with the help of AI. OpenAI said it had led a group of researchers that discovered it, while the security firms Calif and Wiz said they had also identified it using AI tools. Amazon's security chief said an attempt to exploit the flaw had been spotted on one of its decoy systems four days before it was made public.

What it means for small businesses

Many small businesses, charities and community groups in Birmingham run websites built on WordPress or other PHP-based systems. Anyone responsible for such a site should check with their web host or developer that PHP has been updated to the latest version, and that any plugins and themes are also up to date. Many hosting companies apply such updates for their customers, but sites that are managed independently may need updating by hand.