Numerous websites, including those of the Canadian government, experienced downtime on Wednesday to address vulnerabilities discovered in PHP, a widely utilized programming language.
Developers of PHP urgently released patches for software vulnerabilities on Wednesday, advising website operators to promptly apply the fixes. The PHP Foundation emphasized the critical need for immediate updates for all PHP users.
As a precautionary measure, some federal government websites were temporarily taken offline, according to Artificial Intelligence Minister Evan Solomon. Solomon emphasized the importance of organizations running PHP-based websites to implement the security updates promptly.
Websites such as the Canadian Centre for Cyber Security and Statistics Canada were temporarily inaccessible on Wednesday. Additionally, provincial sites for Newfoundland and Labrador and Prince Edward Island, along with Elections B.C., were also offline due to a global security incident.
On the same day, Wikipedia, Cloudflare, and Maple Health also addressed security vulnerabilities in PHP.
PHP, a programming language established in the early 1990s, supports many public-facing websites like WordPress, Drupal, Joomla, and Magento. Websites using PHP assemble content on servers and send it to browsers when visitors load pages. The language, essential for the internet, is open source and maintained by volunteers.
A significant portion of websites on the internet, approximately 75%, runs on PHP, as reported by web technology tracker W3Techs. Ritesh Kotak, a cybersecurity analyst from Toronto, highlighted the widespread vulnerability of websites until the necessary fixes are applied, noting the concerning scale of the situation.
Alphabet-owned cybersecurity company Wiz, utilizing artificial intelligence, discovered the PHP flaw. The vulnerable code, existing for over a decade, required collaboration with various entities such as OpenAI, Automattic, AWS, and Microsoft for patch validation and customer guidance.
While AI aided in identifying and fixing vulnerabilities, Kotak warned of potential misuse by hackers to exploit weaknesses. The prospect of increased cybersecurity incidents in the future is anticipated due to AI’s potential for malicious exploitation.
Across Europe, Australia, Japan, and Britain, cybersecurity agencies advised PHP users to implement the necessary fixes. Governments in France, the Netherlands, and other European nations also proactively shut down websites to address the PHP vulnerabilities.