Government and business websites across Europe were taken down in a bid to protect organisations after a critical software update was issued over vulnerabilities in programming language.The developers of the PHP programming language, which is extensively used across the internet, said on Wednesday a set of new updates fixing two previously identified critical vulnerabilities was now live.
It strongly encouraged users to update software immediately.Those unable to apply key fixes to the widely used software should also consider taking their websites down, UK and international cybersecurity officials have warned.Websites linked to French, Danish, Finnish and Dutch governments all appeared to go offline on Wednesday as organisations scrambled to protect their systems. Some are now back up and running.
Image:
Fears have been raised about hackers exploiting the vulnerabilities. Pic: iStock
Concerns have escalated in recent days that websites running software would be exposed to serious cyber intrusions.PHP said both vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale and urged users to “upgrade as soon as the release is available”.Artificial intelligence agents helped uncover the vulnerabilities.Read more:Speaker scolds government for treating media as ‘more important’ than MPsAustralian MP has both legs amputated, husband confirms
How countries were affectedFrance’s Interior Ministry said it had placed all of its websites into preventive maintenance. Users visiting French government websites were told there was “ongoing maintenance”.In the Netherlands, several organisations took public-facing websites offline, while Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform.Disruption was also widespread in Finland, where state IT services provider Valtori said government public networkservices had been taken offline “as a precautionary measure”.
Image:
The Finnish government website was encountering problems
Elsewhere the European Union Computer Emergency Response Team (CERT-EU) said on Tuesday that the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that can allow attackers to run malicious code on vulnerable systems without logging in.It urged organisations to prepare for the immediate patching of affected assets and said those unable to do so should consider taking their sites offline.Cybersecurity agencies in Britain and Japan are also among those urging PHP users to update immediately or take websites offline until patches can be applied.A government spokesperson said: “Work is already underway across government to actively identify and patch any potential exposure.”We encourage all organisations – private and public, large and small – to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems.”While the US National Security Agency said in a statement that the vulnerabilities “often provide a direct path to the server’s file system or database,” and that if an immediate update was not feasible, organisations should take systems offline for full mitigation.The Australian Cyber Security Centre (ACSC) urged organisations to identify PHP systems in their environments, prepare to apply patches and monitor applications for signs of malicious activity.
Hackers might try to exploit it
Science and technology editor
@t0mclark3
“The first thing to get across is the scale; from Belgium, Germany, France, the Netherlands, and Australia’s government websites are being taken offline.
“It’s important to say this is not because of a hack, it’s because of a vulnerability that has been discovered by cyber security companies and communicated globally by national cyber security agencies – but is a vulnerability so widespread across the internet that it affects government websites, as well as many businesses as well.
“We are going to be seeing in the coming hours and days a huge effort to patch that vulnerability, before, now it’s been made public, nefarious actors, hackers, might try to exploit it.”
The Wikimedia Foundation, which runs online encyclopedia Wikipedia, was one company on Wednesday which said it was in the process of addressing security vulnerabilities in the PHP programming language.Web hosting provider GoDaddy said the flaws could allow attackers to access affected servers which could potentially lead to data theft, website defacement or full system compromise.
Image:
Chiefs from the EU are among those urging sites to update fast. Pic: Reuters
Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare, said that attacks were already happening and Cloudflare was updating its firewall rules as a stopgap measure.He said on X: “We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update.”Don Smith, VP Threat Intelligence, Sophos Counter Threat Unit, said: “Security teams should prioritise internet-facing systems, confirming which versions are affected as soon as the official advisory is published, and apply the updates without delay.”Threat actors move fast, especially with the help of AI and this will likely be a priority target for them over the coming hours and days so it is crucial organisations monitor PHP and web-server processes for unusual processes, command execution or other signs that an attacker may already have gained a foothold.”
Click Here For The Original Source.
——————————————————–
