Numerous websites, including those of the Canadian government, experienced downtime on Wednesday to address security vulnerabilities discovered in PHP, a commonly used programming language.
PHP developers promptly issued critical patches for their software on Wednesday, emphasizing the urgency for website operators to apply the updates without delay. The PHP Foundation stressed the importance of immediate updates for all systems running PHP.
In response to the situation, Artificial Intelligence Minister Evan Solomon confirmed the temporary shutdown of certain federal government websites as a precautionary measure. Solomon urged organizations relying on PHP to promptly install the security fixes to mitigate risks.
Provincial websites for Newfoundland and Labrador and Prince Edward Island also went offline citing a global security incident. Additionally, Elections B.C.’s website was inaccessible on Wednesday, coinciding with the final day of advance voting ahead of the provincial election.
Other prominent platforms such as Wikipedia, Cloudflare, and Maple Health also addressed PHP security vulnerabilities on the same day.
The origins of PHP trace back to the early 1990s, initially standing for “Personal Home Page.” It forms a fundamental component of many public websites, including WordPress, Drupal, Joomla, and Magento. Websites utilizing PHP rely on servers to assemble and deliver content to visitors.
PHP powers approximately 75% of identified programming language-based websites on the internet, according to web technology tracker W3Techs. The widespread use of PHP exposes numerous websites to potential security breaches until the necessary updates are implemented.
Notably, cybersecurity company Wiz, owned by Alphabet, utilized artificial intelligence to uncover the PHP vulnerability. The company confirmed the presence of the flaw in PHP, which had persisted for over a decade. Collaborating with OpenAI and other tech giants, Wiz facilitated the discovery and deployment of patches to address the security issue.
While AI played a crucial role in identifying and resolving vulnerabilities in PHP, cybersecurity analysts warn that hackers could exploit AI to target weaknesses in systems. This dynamic poses an ongoing challenge for cybersecurity efforts and could lead to an increase in cyber incidents in the future.
Cybersecurity agencies across Europe, Australia, Japan, and Britain joined in urging PHP users to apply the necessary fixes. Governments in various European countries, including France and the Netherlands, proactively took their websites offline to implement the security updates.