UK Websites Offline Amid Critical PHP Security Flaw

Numerous websites across the UK have been temporarily taken offline following the discovery of a critical security vulnerability in the PHP programming language. The flaw could enable attackers to gain remote control over web servers that use the widely adopted software.

Organisations such as Oxford City Council and the Office for Budget Responsibility, a Treasury watchdog, were among those that removed their online services as a precautionary measure. Pages for certain BBC programmes were also affected. The Finnish government's official website was partly disabled by the incident.

The National Cyber Security Centre (NCSC) has issued guidance urging organisations to update to a newly released, fixed version of PHP. If an immediate upgrade is not possible, the NCSC recommends taking websites offline to safeguard against potential exploitation.

Widespread Exploitation Attempts

PHP is a foundational language for approximately 70% of websites globally, underpinning popular platforms like WordPress and Magento. Following the announcement of the vulnerability, there was a significant increase in attempts to exploit the flaw. Cloudflare chief executive Matthew Prince reported that attempts surged from thousands to millions within hours of the issue becoming public.

A Government spokesperson stated that work is underway across government departments to identify and address any potential exposures. They encouraged all organisations, both public and private, to follow NCSC guidance to assess their risks and implement necessary security measures.

AI's Role in Discovery and Fix

Reports indicate that the vulnerability was discovered in August by Ryan Austin, a researcher at cybersecurity firm Calif, who utilised an advanced AI model developed by OpenAI. OpenAI confirmed its involvement in a research team that worked to address the flaw, supporting PHP developers in preparing fixes.

OpenAI described the incident as one of the most significant security issues in recent times. The company noted that while AI can help uncover such vulnerabilities, it can also be used by malicious actors. They stated that frontier AI found these issues before attackers did, providing a window for security professionals to prepare defences.

Potential Consequences

Ciaran Martin, former head of the NCSC, warned of the potential for substantial data loss due to the PHP vulnerability. He highlighted risks including the compromise of sensitive payment card details, which could lead to future scams. Martin also suggested the flaw could provide attackers with a foothold into organisations, potentially facilitating ransomware attacks or making it easier to impersonate individuals.