London: A critical security vulnerability in PHP, a programming language used by millions of websites, has prompted website operators and cybersecurity agencies to take urgent steps to protect their systems, with several websites reportedly taken offline as a precaution.
The PHP development team released security updates on Wednesday, October 21, and urged users to upgrade to patched versions immediately. Operators unable to update their systems were advised to consider temporarily taking vulnerable websites offline.
Cybersecurity company Wiz said artificial intelligence (AI) helped researchers identify the flaw, which had reportedly remained undetected in PHP code for more than a decade. The discovery has raised concerns that attackers could also use AI tools to identify and exploit software vulnerabilities on a large scale.
PHP is widely used to build and operate websites. The scale of its use means that unpatched systems could leave a large number of websites vulnerable to cyberattacks.
Cybersecurity agencies in Europe, Australia, Japan and the UK reportedly urged organisations to apply the security updates without delay. Some organisations took websites offline as a precaution while assessing their exposure to the vulnerability.
The incident has also highlighted the challenges faced by smaller website operators, who may have fewer technical resources to install security patches quickly.
Website administrators have been advised to install the official PHP security updates, check that their systems are running supported versions and review their servers for signs of unauthorised access.
