PHP Exposed to Severe Security Vulnerabilities, Websites of Institutions in Multiple Countries Temporarily Taken Offline
The UK National Cyber Security Centre issued an alert stating that the PHP scripting language, widely used in website development, has two severe security vulnerabilities; attackers can trigger memory exhaustion to cause memory corruption and, under specific conditions, remotely execute code. The PHP development team released an emergency security update on the 21st to fix the vulnerabilities. The UK Office for Budget Responsibility, Finland's government public network services, and the Netherlands' cybersecurity agency, among others, temporarily took their websites offline out of security concerns. Cloud service vendors such as Tencent Cloud and Alibaba Cloud have issued vulnerability notices, reminding users to investigate and update as soon as possible or take mitigation measures; BBC reported that these vulnerabilities were discovered by researchers at cybersecurity firms with the help of artificial intelligence tools, and had existed for more than a decade without being detected.
Why read this
AI score 65
The incident presents the response chain of institutions temporarily taking websites offline and cloud vendors issuing notices after vulnerability disclosure, and also highlights the new development that the vulnerabilities were discovered by AI tools.
Topics
Body · AI translation
LONDON, Oct. 21 (Xinhua) -- The UK National Cyber Security Centre issued an alert on Oct. 21 saying that PHP, a scripting language widely used in website development, has serious security vulnerabilities that could be exploited by attackers. For security reasons, institutions in multiple countries have taken preventive measures and temporarily taken their websites offline.
PHP is a widely used server-side scripting language. It runs on servers and is used to generate web page content and interact with databases, and is also widely integrated into other products. This security issue involves two vulnerabilities. Attackers may trigger a memory exhaustion state, cause memory corruption, and under specific conditions exploit the vulnerabilities to execute code remotely. On Oct. 21, the PHP development team released an emergency security update, and the vulnerabilities have been fixed.
The UK National Cyber Security Centre recommends that relevant institutions immediately take measures to update PHP to the latest version. Institutions unable to upgrade in time should adopt temporary mitigation measures; if these measures cannot be implemented or would take too long, they should consider temporarily taking systems offline until the risk is fully mitigated.
Chinese cloud service providers such as Tencent Cloud and Alibaba Cloud have issued vulnerability notices, reminding relevant users to promptly check the use of PHP in their businesses and, if within the affected scope, complete updates or adopt mitigation measures as soon as possible.
The impact of this incident is quite broad. According to British media reports, institutions in multiple countries have taken preventive measures for security reasons. The UK Office for Budget Responsibility temporarily took its website offline, Finland temporarily shut down government public network services, and the Dutch cybersecurity agency also temporarily took its website offline.
Cybersecurity experts said ordinary users do not need to panic, because PHP runs on servers rather than personal internet devices. If a website is temporarily inaccessible, it may be a proactive risk-avoidance measure, and whether personal information is affected depends on follow-up notices. If a website subsequently issues a data breach notice, users can take security measures such as changing passwords according to the instructions.
The BBC reported that these vulnerabilities were discovered by researchers at a cybersecurity company using artificial intelligence tools, and had existed for more than a decade without being detected.
Dane Knecht, chief technology officer of a US cloud cybersecurity services company, said on social media that this will not be the last time such vulnerabilities are discovered, and that artificial intelligence models will continue to find similar vulnerabilities in widely used software. Software maintainers, researchers, service providers and governments need to develop a new set of joint response plans so that they can respond and handle vulnerabilities more quickly after discovery.