Websites taken offline in race to patch PHP security flaw

Companies and governments are racing to protect their websites against critical security vulnerabilities in a widely used programming language, as warnings mount over hackers attempting to exploit the flaws.

The moves in Asia follow a wave of precautionary shutdowns in Europe and the US as developers of PHP started releasing urgent fixes on Wednesday.

Security services worldwide, including the National Security Agency and Europe’s cyber security body, have warned companies to take immediate action. Government websites have been taken offline in a bid to protect systems.

PHP — originally an abbreviation of Personal Home Page — has been found to contain two serious security issues that could make companies and organisations using the language vulnerable by allowing hackers to attack without needing to log in.

The flaws were uncovered with the help of OpenAI and Google models after being undetected for more than a decade, underscoring how AI has set off an arms race between hackers and companies.

Japan’s Prime Minister Sanae Takaichi issued an urgent public warning on Wednesday night, calling on companies to install the fixes as quickly as possible and consider suspending services if necessary.

“If it is difficult to apply the patches promptly, temporarily shutting down websites or other services may also be an effective way to reduce the risk,” she said in a social media post.

Cybersecurity agencies across Asia, including in Taiwan, Hong Kong and Singapore, have also issued warnings and advice.

The Australian Signals Directorate issued a warning late on Wednesday urging businesses and internet users to update security patches. However, the PHP problem led to some government websites becoming unavailable.

A spokesperson for Tony Burke, Australia’s cyber security minister, said some government sites would remain unavailable as work to fix vulnerabilities took place.

Alibaba Cloud and Tencent Cloud issued warnings on Wednesday night and asked clients to update to the latest debugged version of PHP as soon as possible.

Wikipedia said users might experience outages. “We have deliberately taken many of our supporting services offline until they can be safely patched,” it said.

A slew of Japanese companies suspended services as a precaution.

The airline ANA said on Wednesday that it had suspended its website and app services including Apple Wallet boarding passes as a “preventive measure”.

Japanese financial groups, from regional lenders to brokerage Nomura and megabank Mitsubishi UFJ Financial, have suspended some non-core services. MUFJ said the suspension did not affect payments.

Asahi Group, Japan’s largest brewer, confirmed a precautionary suspension of some websites and systems, while railways were also affected with Keihan Holdings suspending its website. Gaming groups Sega and Bandai Namco said they were conducting emergency maintenance on parts of their websites.

Japan has already said it is facing a “state of emergency in cyber space” due a recent spate of hackings.

Toshio Nawa, a leading Japanese cyber security adviser, said that the scale and duration of website and service shutdowns in Japan reflected management teams lurching from “refusing to accept downtime to refusing to accept any uncertainty” of cyber attacks.

He said such responses amounted to “decision-making paralysed by the fear of blame” following scores of executives bowing in apology at press conferences. “That failure of management judgment is the deeper vulnerability exposed by these shutdowns,” Nawa added.

Recommended

The PHP vulnerabilities were discovered by researchers at two US cyber security groups, Calif and Wiz. Alphabet-owned Wiz estimated the compromised programming language powered about 70 per cent of all websites. WordPress, the most widely used website-building platform, is written primarily in PHP.

Amazon said it had identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public and that the flaws were “now being broadly exploited in the wild”.

Rashina Hoda, an academic at Monash University in Melbourne, said: “While major banks and companies typically do not rely on PHP for sensitive transactions, other businesses that depend heavily on providers such as WordPress for their websites, which in turn leverage PHP, are particularly vulnerable and will need to secure their services.”

Hoda also warned of a possible surge in scams and phishing attacks.