PHP Exposed to Severe Security Vulnerabilities, Websites of Institutions in Multiple Countries Temporarily Taken Offline
English text is being prepared.
The UK National Cyber Security Centre issued an alert stating that the PHP scripting language, widely used in website development, has two severe security vulnerabilities; attackers can trigger memory exhaustion to cause memory corruption and, under specific conditions, remotely execute code. The PHP development team released an emergency security update on the 21st to fix the vulnerabilities. The UK Office for Budget Responsibility, Finland's government public network services, and the Netherlands' cybersecurity agency, among others, temporarily took their websites offline out of security concerns. Cloud service vendors such as Tencent Cloud and Alibaba Cloud have issued vulnerability notices, reminding users to investigate and update as soon as possible or take mitigation measures; BBC reported that these vulnerabilities were discovered by researchers at cybersecurity firms with the help of artificial intelligence tools, and had existed for more than a decade without being detected.
Why read this
AI score 65
The incident presents the response chain of institutions temporarily taking websites offline and cloud vendors issuing notices after vulnerability disclosure, and also highlights the new development that the vulnerabilities were discovered by AI tools.
Topics
Body
新华社伦敦10月21日电（记者张家伟）英国国家网络安全中心21日发布警报说，广泛用于网站开发的PHP脚本语言存在严重安全漏洞，可能被攻击者利用。出于安全考虑，多国机构采取预防性措施，将网站临时下线。
PHP是一种广泛使用的服务器端脚本语言。它在服务器上运行，用于生成网页内容、与数据库交互，也被大量集成到其他产品中。此次安全问题涉及两个漏洞，攻击者可能通过触发内存耗尽状态，造成内存损坏，并在特定条件下利用漏洞远程执行代码。21日，PHP开发团队发布紧急安全更新，漏洞已被修复。
英国国家网络安全中心建议，相关机构应立即采取措施，将PHP更新到最新版本。无法及时升级的机构应采取临时缓解措施；若这些措施无法实施或耗时过长，应考虑暂时将系统下线，直至风险得到充分缓解。
中国腾讯云、阿里云等云服务厂商已发布漏洞通告，提醒相关用户尽快排查业务中PHP的使用情况，若在影响范围内，应第一时间完成更新或采取缓解措施。
此次事件影响范围颇广。据英国媒体报道，多国机构出于安全考虑而采取预防性措施。英国预算责任办公室暂时将其网站下线，芬兰临时关闭政府公共网络服务，荷兰网络安全机构也将其网站临时下线。
网络安全专家介绍，普通用户无需恐慌，因为PHP运行在服务器上，而非个人上网设备里。如果某个网站暂时打不开，可能是主动避险行为，个人信息是否受影响要看后续通知。若网站后续发布了数据泄露通知，用户可根据提示采取更换密码等安全措施。
英国广播公司报道说，这些漏洞由网络安全企业研究人员借助人工智能工具发现，此前已存在十余年而未被察觉。
美国云网络安全服务公司首席技术官戴恩·克内克特在社交媒体上表示，这不会是最后一次发现此类漏洞，人工智能模型将不断在广泛使用的软件中发现类似漏洞。软件维护者、研究人员、服务提供商和政府需要制定一套新的共同应对方案，做到发现漏洞后能更快响应处置。