Critical vulnerabilities in PHP, one of the web’s most widely used programming languages, sent website operators scrambling on Wednesday.
MenaToday.info, which runs on PHP, was also affected by the vulnerabilities © Mena Today
Critical vulnerabilities in PHP, one of the web’s most widely used programming languages, sent website operators scrambling on Wednesday.
Government sites across Europe went offline as a precaution, and experts warned of a wave of attacks now that a fix is public. MenaToday.info was also affected, but its technical teams kept the site online throughout.
PHP’s developers released emergency fixes on Wednesday and urged all users to update immediately. The flaws had gone unnoticed in the code for more than a decade before being uncovered with the help of artificial intelligence, according to cybersecurity firms Calif and Wiz, which coordinated the discovery with the PHP team.
The stakes are enormous. PHP powers around three-quarters of websites whose programming language can be identified, according to W3Techs, and sits behind platforms such as WordPress, Drupal, Joomla and Magento.
The Drupal Association warned that servers running any PHP version released in the past two decades are vulnerable, while internet intelligence firm Censys estimates that more than half of the hosts it tracks run versions for which no fix exists.
Experts fear that AI tools will allow hackers to reverse-engineer the flaw quickly and target unpatched servers at scale. Amazon said it had detected an exploitation attempt on one of its decoy systems four days before the vulnerability was made public, and that the flaws are now being widely exploited.
Mass outages
In the Netherlands, the national cybersecurity agency took its own site offline, followed by the Port of Rotterdam, the government portal Overheid.nl, the national football association, the country’s five largest political parties and several hospitals.
Finland shut down government public network services, Denmark suspended its national school communication platform and France placed all Interior Ministry websites into preventive maintenance. Wikipedia and the Internet Archive also took systems offline temporarily.
Small websites with limited technical resources, often on shared hosting, are considered the most exposed, as they may take longer to apply the fix.
MenaToday.info stays online
MenaToday.info, which runs on PHP, was also affected by the vulnerabilities. Its technical teams took preventive measures and kept the site online, although some features were temporarily restricted.
Israeli digital advertising agency Discover-Tech spied on internet users through a sprawling network of online ads that it used to track targets and help hack their devices, two research groups said on Thursday.
A cell of "malicious actors" based in northern Yemen used Claude, the artificial intelligence system built by US company Anthropic, in an attempt to develop guided weapons, the company announced Thursday, as Iran-backed Houthi rebels press a major offensive across Yemen.
The U.S. Department of Commerce loosened export controls on the United Arab Emirates on Friday, making it easier to export military items, certain commercial satellites and spacecraft, according to a U.S. government posting in the Federal Register.
To make this website run properly and to improve your experience, we use cookies. For more detailed information, please check our Cookie Policy.
Necessary cookies enable core functionality. The website cannot function properly without these cookies, and can only be disabled by changing your browser preferences.