Race to update services' computer systems after cyber-security flaw found
0 / 47
English
中文
How did AI discover the internet's massive cyber-security risk?
（暂无翻译）
Organisations and businesses are still scrambling to update their systems after cyber-security flaws were revealed in a widely-used programming language, PHP.
（暂无翻译）
Websites around the world were taken offline on Wednesday and Thursday after the developers of PHP said "critical vulnerabilities" were found in the back-end language, used in web development for decades.
（暂无翻译）
Researchers warned the "severe" flaws could expose millions of sites using it to potential hacks if left unpatched - and the UK government was among those to take some sites offline as a precaution.
（暂无翻译）
There have been no successful attacks reported so far, but experts say any impact may take time - even months - to become fully apparent.
（暂无翻译）
Downing Street said on Thursday "some" limited government services "may be offline" while security work was being carried out.
（暂无翻译）
"The information I have is that 32 Government services are unavailable and four are partially unavailable," tech minister Baroness Lloyd of Effra told the House of Lords.
（暂无翻译）
She attributed this to having "largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied".
（暂无翻译）
The government did not specify which services were taken offline - but it said no large UK public-facing critical services had been affected.
（暂无翻译）
A spokesperson said work had already taken place across government to "identify and fix potential exposures to our systems and our experts are continuing to work closely with both OpenAI and international partners on this issue".
（暂无翻译）
"But this does not mean they were hacked, and work continues to resolve any issues," they added.
（暂无翻译）
Olly Whitehouse, chief technology officer of the National Cyber Security Centre (NCSC), called the event "unprecedented".
（暂无翻译）
"It will be universally felt, I suspect," he told BBC Radio 4's World At One.
（暂无翻译）
But he said there were "no indications" of any successful breaches by hackers.
（暂无翻译）
He said the NCSC was "starting to see positive confirmation" that advice sent to those affected, external had been received and was being acted on.
（暂无翻译）
Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb What is PHP and why did it spark a global cyber-security scramble?
（暂无翻译）
Cyber-security lecturer Rory Hopcraft told the BBC the government needed to make sure that its own infrastructure was up-to-date.
（暂无翻译）
"Hacking has been around for many years," he said.
（暂无翻译）
"The government are the ones who set the rules for other organisations... they just need to effectively be practising what they're preaching at this point."
（暂无翻译）
Dean Presley, who has a garage in Chepstow, South Wales, told BBC Your Voice he had been unable to properly process MOTs online.
（暂无翻译）
He said his computer system had been down since Wednesday morning, and while he has experienced outages before, they have not lasted this long.
（暂无翻译）
"MOTs can be conducted and they're legal but none of the paperwork and certificates can be printed and they're not on the system," Dean said.
（暂无翻译）
He said this has forced him to write everything on paper documents, leading to delays for customers.
（暂无翻译）
PHP stands for PHP: Hypertext Preprocessor.
（暂无翻译）
It's a programming language which runs on a web server, behind the scenes of a website, and effectively lets you see the sites you visit.
（暂无翻译）
When you go to a site, PHP is the code which collects data and effectively turns it into a page you can read.
（暂无翻译）
It was developed in the early 1990s to help serve dynamic web pages and applications, but still powers lots of platforms today.
（暂无翻译）
PHP has been used across a wide range of platforms including Wikipedia, online shops and WordPress – the system behind many websites - as well as to write tools to build web apps, with Laravel, Symfony and Drupal among popular PHP frameworks.
（暂无翻译）
According to cyber-security firm Wiz, external, which helped uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world's websites.
（暂无翻译）
And it said the flaws - now coined "php2shell" - were inherent in the language itself, affecting many past versions of it.
（暂无翻译）
The PHP Foundation, the non-profit which maintains the programming language, warned this meant that, under the right conditions, an unauthenticated attacker would be able to remotely execute code on servers running PHP.
（暂无翻译）
Some large organisations said they had seen a high volume of attempts to breach their systems.
（暂无翻译）
Matthew Prince, the boss of internet infrastructure firm Cloudflare, wrote on X, external on Thursday that the company saw "thousands" of attempts to exploit the PHP vulnerabilities across its network in the 10 hours before it was publicly announced.
（暂无翻译）
"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now," he added.
（暂无翻译）
Amazon also says it saw hackers attempt to exploit the flaws, but its websites were operating as normal.
（暂无翻译）
Cyber researchers at Calif and Wiz unearthed the php2shell flaw, theorised by the PHP Foundation in 2024, in part using OpenAI tools While the impact of the PHP flaw remains to be seen, disruption continued for businesses and organisations after many sites were taken down on Wednesday.
（暂无翻译）
The website of a Dutch agency specialising in cyber-security, Finland's government and parts of Wikipedia, taken temporarily offline, had returned to business as usual by Thursday.
（暂无翻译）
But a number of sites appeared to have been taken offline on Thursday, as operators rushed to check if PHP might be running within their systems or if any patches were required.
（暂无翻译）
In France, telecommunications company Orange also said, external it had suspended access to certain services globally while it deployed security fixes.
（暂无翻译）
According to some cyber-security researchers using scans to check servers at risk of the PHP vulnerability, the rate of organisations implementing patches - but not as quickly as might be hoped globally.
（暂无翻译）
"The window to respond has shrunk dramatically," said Matt Hull, VP of cyber intelligence and response at global cyber security company NCC Group.
（暂无翻译）
"A few years ago, attackers might have taken weeks to exploit a vulnerability.
（暂无翻译）
Now, it can be days or hours."
（暂无翻译）
Hull also highlighted the extent of the task facing developers and engineers working to deal with the issue. "Several days into this incident, security professionals might already be dealing with significant burnout," he said, urging a need to "make time to rest, share the workload and look after each other".
（暂无翻译） （暂无翻译）
"Resilience depends on people as much as technology."
（暂无翻译）
UK working to identify exposure after global cyber-security warning
（暂无翻译）
仅供学习使用，如有侵权请联系删除 · 查看原文