Websites taken down worldwide as critical cyber-security update issued
0 / 47
English
中文
International governments and agencies have urged websites to address two critical cyber-security flaws in a programming language which powers much of the internet.
（暂无翻译）
The vulnerabilities were found within the PHP programming language, with a fix issued on Wednesday afternoon.
（暂无翻译）
Multiple cyber-security agencies have urged organisations unable to apply fixes in time to consider taking their sites down, leaving bodies such as the Finnish government, Edinburgh council and the BBC to take pages offline.
（暂无翻译）
The flaws were discovered by AI, with cyber-security firm Wiz saying they were the "most severe vulnerabilities ever discovered" by the tech, which is reshaping the cyber landscape.
（暂无翻译）
Finland has temporarily shut down the government's public web services, while the Netherlands' cyber-security agency said it was taking its own website offline due to the vulnerabilities.
（暂无翻译）
The US National Security Agency issued similar advice on X, external for organisations to take their systems offline if they were unable to update with the fix.
（暂无翻译）
"These vulnerabilities often provide a direct path to the server's file system or database," it wrote.
（暂无翻译）
Meanwhile, the White House said federal agencies were working with leading AI labs to speed up a fix to the issue.
（暂无翻译）
And in a post on X, external, Japan's Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP.
（暂无翻译）
The Wikimedia Foundation, which runs the online encyclopedia Wikipedia, said it was addressing the security vulnerabilities.
（暂无翻译）
"We have taken down a number of other systems as a precautionary measure until they can be safely patched," it said.
（暂无翻译）
That led some people to be unable to access parts of Wikipedia on Wednesday.
（暂无翻译）
Edinburgh council's website has also become inaccessible, as well as the online homes for several BBC programmes including Doctor Who and The Traitors.
（暂无翻译）
They have not confirmed a link to PHP - BBC News has approached them for comment.
（暂无翻译）
Other websites, including the art platform DeviantArt, have said they are "temporarily down for maintenance, external" without specifying the reason.
（暂无翻译）
The vulnerabilities were discovered by cyber-security researchers at the firms Calif and Wiz.
（暂无翻译）
Calif, along with PHP Foundation, were part of a program started by OpenAI called Patch the Planet.
（暂无翻译）
Through that program, they were given access to the AI company's advanced AI tools in order to find and fix flaws in web development language.
（暂无翻译）
OpenAI said in a blog post, external that the discovery was "one of the most impactful security issues in recent memory". It added an internal researcher at the company had also discovered the issue arund the same time as the other firms.
（暂无翻译） （暂无翻译）
The flaws had gone undetected for more than a decade. By August, after a few weeks of using advanced AI tools, they were discovered.
（暂无翻译） （暂无翻译）
"Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours," Wiz said in a blog post.
（暂无翻译）
It has estimated "roughly 70%" of the internet is affected, though the BBC is unable to verify that figure.
（暂无翻译）
While PHP Foundation intended to release its discovery later this month along with a complete fix for the problem, usually referred to by software developers as a "patch," details of the flaw were leaked on social media on Tuesday.
（暂无翻译）
It forced PHP Foundation to rush out its announcement of the vulnerability and its huge scale.
（暂无翻译）
The Netherlands' National Institute for Public Health and the Environment, an agency of the Dutch government, has taken down its website.
（暂无翻译）
Similarly the website of the Tweede Kamer, the lower house of the nation's parliament, has become inaccessible.
（暂无翻译）
The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia have urged those who use PHP to apply the fixes.
（暂无翻译）
"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC said in a note, external.
（暂无翻译）
Japan's national cyber-security office and EU cyber-security officials have issued a similar warning, external.
（暂无翻译）
"PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," cyber-security company Huntress said.
（暂无翻译） （暂无翻译）
Cyber-security expert Don Smith, from the Sophos Counter Threat Unit, told the BBC this would "likely be a priority target" for hackers.
（暂无翻译）
The immediate challenge was not simply installing a patch to fix the issue, but finding and managing every instance where PHP was running, he said.
（暂无翻译）
"The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it," he said.
（暂无翻译）
He said it was crucial that organisations looked out for signs that an attacker "might have already have gained a foothold".
（暂无翻译）
The European Union Computer Emergency Response Team (CERT-EU) said the risk scores given to the vulnerabilities "indicate the potential for unauthenticated remote code execution".
（暂无翻译）
Such a cyber-attack could potentially allow hackers to install malware and take down websites.
（暂无翻译）
Dane Knecht, chief technology officer at internet infrastructure firm Cloudflare, said he was, external "seeing early attacks emerging and are updating mitigations as new vectors show up".
（暂无翻译）
The NCSC said once organisations have installed the update, they should "continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP".
（暂无翻译）
It is not yet clear which versions of the programming language are affected, but CERT-EU said it could affect all versions of it dating back to PHP 5 onwards - which launched in 2004.
（暂无翻译）
The PHP Foundation has issued the update only for the latest versions however - with people using PHP 8.1 or older being urged to upgrade.
（暂无翻译）
PHP was created for web development. It is used on servers to implement what you see when you visit websites.
（暂无翻译） （暂无翻译）
Not all websites use it, but it nonetheless powers a large portion of the internet.
（暂无翻译）
King warns malicious online actors are evolving tactics UK cyber chiefs say it's time to ditch passwords for passkeys - what are they?
（暂无翻译）
仅供学习使用，如有侵权请联系删除 · 查看原文