Critical PHP flaws prompt websites to go offline for updates

Summarised from 2 outlets · Updated 23 Oct, 00:32 · Archive

Two critical vulnerabilities discovered in PHP, the programming language powering about 70% of websites globally, prompted governments and organisations to take sites offline Wednesday for emergency updates.

Two critical vulnerabilities in PHP, a widely used web programming language, prompted governments and organisations across Europe and the United States to take websites offline Wednesday for emergency security updates.

The FBI's cyber division warned that the flaws could allow malicious actors to remotely execute code in systems running PHP, potentially compromising sensitive data and networks. The PHP Foundation released fixes and instructions for updating systems on Wednesday. According to cybersecurity experts, attackers exploiting the vulnerabilities could gain unauthenticated access to websites, allowing them to control web servers remotely without passwords, steal data, alter information or launch further attacks.

PHP powers approximately 70% of websites globally, including the content management systems WordPress, Drupal and MediaWiki, which runs Wikipedia. The Finnish government website was among those experiencing temporary disruption. The vulnerabilities were uncovered with assistance from artificial intelligence researchers. OpenAI said it had led a coalition of researchers, security providers and others including Wiz and Cloudflare to address the vulnerabilities over the previous two months, with PHP's maintainers leading the fixes and release.

How it is being reported

• What to know about the AI-detected security bug impacting wide swaths of the internetPHP is a widely used general-purpose scripting language that is geared toward web development, and thus, it powers the majority of websites around the world. When the organization behind the language and the FBI’s cyber division warned Wednesday of significant vulnerabilities in the language, government agencies, corporations and other organizations were sent into a flurry.Woodtv · 23 Oct, 00:02
• Some websites go dark as operators address an AI-detected flaw in a web programming languageThe FBI’s cyber division warned Wednesday about the discovery of two “critical vulnerabilities” in PHP, a widely used programming language that powers many websites and web applications. The FBI said the vulnerabilities could allow malicious actors to remotely execute code in the PHP core, potentially compromising sensitive data and networks. The PHP Foundation, which includes developers who work on securing and working on the programming language, said Wednesday it has released fixes for the vulnerabilities along with instructions on how to update systems.WILX · 21 Oct, 22:06

In this story: PHP Foundation · FBI · OpenAI · Finnish government · WordPress · Drupal · Wikipedia

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem