Global firms and g o v e r n m e n t s rushed on October 22 to patch critical flaws in the PHP programming language that underpins much of the internet, as cloud firms reported a surge of hacking attempts after the vulnerabilities were disclosed.
The push came after governments in Europe and elsewhere took websites offline as a precaution while website operators scrambled to secure systems running the software.
The emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki mark one of the most dramatic tests of the decades-old programming tools that keep the web running, exposing how deeply governments and companies depend on code that few people understand.
“I’ve not seen anything like this in a long, long time,” Microsoft CEO Satya Nadella said at an event in Germany, saying the incident showed the importance of building software that can be maintained securely as systems grow more complex.
The developers of PHP – a computing language like HTML and Python – released fixes on OC 21 for vulnerabilities that had lurked in the software for years until they were uncovered using AI. They urged users to “update immediately”.
Madeline Lawrence, cofounder of Belgian cybersecurity firm Aikido Security, said that details of the flaws had become public before fixes were ready, with attacks reported since.
“Companies are racing to update against attackers who can use AI to exploit them. That’s the whole race,” she said.
Temporary suspension Japanese companies including brokerage Nomura, lender Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway said they were temporarily suspending some internet services as part of emergency measures.
Japan’s Ministry of Finance and Meteorological Agency partially suspended online services. French telecoms group Orange said it had temporarily suspended access to certain PHP-based websites. Tencent Cloud, one of China’s largest cloud-computing providers, urged customers to install updated PHP versions.
WHAT IS THE BUG?
PHP is Hypertext Preprocessor, an opensource, back-end programming language which runs on a web server. Developed in the early 1990s to help serve dynamic web pages and applications, PHP still powers lots of platforms today.
It has also been used to write a number of tools for building or speeding up the creation of web apps. PHP powers 70 per cent of the world’s websites. It is maintained by a non-profit called the PHP Foundation.
Hackers could exploit the php2shell issue to take control of affected web servers and steal sensitive data. AI could also make such attacks easier and faster
