Government, school and hospital websites were taken offline across Europe and elsewhere on Wednesday after warnings that two critical flaws in PHP, a widely used programming language, could allow attackers to take control of vulnerable servers.
The United States National Security Agency (NSA) urged organisations to prepare for emergency updates and take affected systems offline if they could not be secured.
“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities,” the NSA said in a social media post.
PHP’s developers said a set of new updates fixing the two vulnerabilities was available on Wednesday afternoon. Britain’s National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia, urged those using PHP to apply the fixes.
“Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the NCSC said.
Germany’s digital ministry said it had suspended some websites as a precaution, while France’s Interior Ministry took down websites serving local administrative offices.
Shutdowns were also reported in Belgium, the Netherlands, Finland and the Czech Republic.
Japan’s Finance Ministry and Meteorological Agency suspended parts of their online services, while the National Tax Agency temporarily withdrew an online service. The BBC said some of its web portals had also been taken offline.
The Wikimedia Foundation, which operates Wikipedia, said the vulnerabilities affected its own systems and services run by volunteers wherever they used PHP.
“We have taken down a number of other systems as a precautionary measure until they can be safely patched,” the foundation added.
‘Among the Most Severe Vulnerabilities’
Researchers at cybersecurity firms Calif and Wiz investigated the vulnerabilities, known as PHP2Shell, with the help of artificial intelligence.
Calif reported a critical flaw on August 11 through its work under OpenAI’s Patch the Planet programme. Wiz submitted findings from its separate investigation on August 24.
Wiz said the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history”.
According to the firm, the underlying flaws had existed for decades. Demonstrating how attackers could exploit them, however, required a sequence of steps “at the edge of what human researchers could practically achieve”.
“Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours,” Wiz said in a blog post.
The vulnerabilities could enable attackers to execute commands remotely on affected servers without supplying a password or signing into an account.
Dane Knecht, chief technology officer at internet infrastructure firm Cloudflare, said it was seeing early attacks and updating protections as new methods emerged.
Don Smith, a cybersecurity expert at the Sophos Counter Threat Unit, told the BBC the vulnerabilities would “likely be a priority target” for hackers. He said organisations needed to identify every part of their systems that used PHP, as installing an update alone would not resolve the challenge.
“The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it,” he said.
The PHP Foundation warned that AI would accelerate the discovery of vulnerabilities and appealed for more support for the engineers responsible for maintaining the software.
“Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing,” the foundation said.
With reporting from Reuters, BBC and Al Jazeera.