US Urges Fix for Widely Used Software After Critical Alerts
The US government is working to address and stop any potential cybersecurity issues stemming from flaws in PHP, a widely used open-source software, that may impact federal agencies and American critical infrastructure, according to a White House official.
The programming language, called PHP, contains two vulnerabilities which could potentially expose organizations using it in websites and software platforms to cyberattacks. The developers responsible for maintaining PHP said Wednesday they released software updates to patch the vulnerabilities, urging users to adopt those changes immediately. The US government is coordinating with technology companies to adopt the security fix, according to a White House official.
PHP is one of the web’s most widely deployed technologies, underpinning millions of websites. Any vulnerability could therefore cascade through the internet’s software supply chain, potentially exposing online services to data theft, malware and breaches. Taking sites offline means attackers can’t reach and exploit the flaw while it’s being fixed.
Alphabet Inc.-owned cybersecurity company Wiz said in a report published Wednesday that it had discovered the vulnerabilities with the help of several artificial intelligence tools. It said it had collaborated with OpenAI and the cybersecurity firm Calif on the work. Wiz’s report estimated that the PHP vulnerability affected around 70% of the internet and had existed undetected for more than a decade, but AI tools helped quickly identify a fix for them.
“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” it said.
The US Office of the National Cyber Director was coordinating with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and others to remediate the issue.
Governments in Europe were taking websites offline Wednesday in response to warnings about the critical security vulnerabilities. Finland’s government said it was taking offline all public-facing internet services as a precautionary measure. Dutch national and local government websites were also taken down.
The UK’s National Cyber Security Centre said in an alert Wednesday that organizations should work to identify any systems running PHP, check them for malicious activity, and consider taking them offline until the vulnerabilities can be mitigated.
The websites for the Dutch House of Representatives and the National Cyber Security Centre couldn’t be reached as of 5:40 p.m. local time. Dutch news agency ANP reported more than 100 municipalities, provinces and water boards were affected as they use a service provided by software firm Notubiz. Notubiz counts 254 Dutch local authorities as customers, according to its website. Notubiz did not immediately respond to a request for comment.
Some universities in Germany and Austria have also pulled their sites, including the University of Vienna and the University of Freiburg.
PHP is “everywhere” and quietly powers websites that run using WordPress, Drupal, Joomla and Magento, according to the cybersecurity firm Huntress. PHP is also present “under the hood” of software, even though the software may not advertise that it is using it, Huntress said.
When there is a critical vulnerability in PHP, Huntress advised in a report on Wednesday, “the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast.”
Dane Knecht, chief technology officer at cybersecurity firm Cloudflare Inc., said in a post on X that his company had observed some “early attacks” attempting to exploit the vulnerabilities. In response, he said, Cloudflare had introduced protections for customers whose sites were shielded using its technology.
Photo: Photo credit: Chris Ratcliffe/Bloomberg