By Staff Reporter.
Government agencies, news organisations and businesses across the world have temporarily shut down websites or suspended some online services as cybersecurity teams rush to address critical vulnerabilities discovered in PHP, a programming language widely used to power websites.
The security concerns have prompted urgent warnings from the United States National Security Agency (NSA) and Europe’s cybersecurity agency, with website operators urged to install security updates to protect their systems against potential cyberattacks.
According to reports, the vulnerabilities, collectively referred to as PHP2Shell, could allow attackers to compromise vulnerable websites and access computer memory containing sensitive information, including passwords.
PHP is used extensively across the internet, including by popular content management systems such as WordPress and Drupal, making the flaws a significant concern for organisations that rely on the technology to operate their online platforms.
The PHP Foundation, which supports the development of the programming language, has released patches to address the vulnerabilities and urged website administrators to update affected systems immediately.
UK Government Services Affected
The impact of the security exercise has extended to government services in the United Kingdom, where nearly three dozen services were reportedly unavailable and four others were partially unavailable while security upgrades were carried out.
UK government minister Elizabeth Lloyd disclosed the disruptions during a session in the House of Lords on Thursday.
A UK government spokesperson said no major public-facing critical services were affected, although some limited services could remain temporarily offline while security work continued.
The temporary shutdowns are part of efforts to reduce the risk of exploitation as organisations work to secure vulnerable systems.
Irish News Website Temporarily Goes Offline
The Journal, a popular Irish news website, was also temporarily unavailable on Thursday morning as its technical team strengthened its security measures.
A notice published by the outlet said the temporary disruption was necessary to bolster its defences against potential threats.
The incident highlights how cybersecurity vulnerabilities affecting widely used software can disrupt access to essential information and services, even when organisations take precautionary measures rather than responding to a confirmed attack.
AI Helps Uncover Long-Standing Vulnerabilities
The vulnerabilities were reportedly identified by teams at OpenAI, cybersecurity company Wiz, which is owned by Google, and another cybersecurity firm identified in reports as Calif.
The discovery has drawn attention to the growing role of artificial intelligence in cybersecurity, particularly its ability to help researchers identify weaknesses in software that may have remained undetected for years.
Although AI-assisted vulnerability discovery can help security teams identify and fix flaws before malicious actors exploit them, the same discoveries can create urgent challenges for organisations responsible for securing affected systems.
Cybersecurity experts have warned that vulnerabilities in widely deployed software can expose large numbers of organisations to risk, particularly when systems are not updated promptly.
Online Businesses Urged to Act
The potential consequences extend beyond government websites and news platforms to online marketplaces, booking services, subscription platforms, delivery applications and utility portals.
Nigel Green, chief executive of financial advisory firm deVere Group, warned that the extensive use of PHP could expose a broad range of online services to security risks.
He noted that platforms handling payments and other sensitive transactions could be vulnerable if their underlying systems rely on affected software.
However, the discovery of a vulnerability does not automatically mean that a website has been hacked or that customers’ financial information has been stolen.
The immediate priority for operators is to determine whether their systems are affected, install the appropriate security patches and assess any signs of attempted exploitation.
World Leaders Call for Urgent Action
The security concerns have also attracted the attention of political leaders.
Dutch Prime Minister Rob Jetten said his cabinet was closely monitoring the situation surrounding the PHP vulnerabilities.
Japan’s Prime Minister Sanae Takaichi urged companies to check whether their publicly accessible websites use PHP and prepare to apply the available security fixes as quickly as possible.
She also indicated that businesses should consider suspending services where necessary to reduce their exposure to potential attacks.
The warnings underscore the importance of rapid coordination between software developers, cybersecurity agencies and organisations operating internet-facing services.
As security teams continue to implement updates, website operators are being urged to prioritise patching vulnerable systems, review their security controls and monitor for suspicious activity to minimise the risk of exploitation.
Credit:CNN
