Websites around the world were taken offline on Wednesday and Thursday after the developers of PHP said ‘critical vulnerabilities’ were found in the back-end language, used in web development for decades.
There have been warnings that the serious flaws could expose millions of sites using it to potential hacks if left unpatched.
The UK government and the States were among those to take some sites offline as a precaution.
‘Islanders will be aware from national media reporting that a PHP vulnerability has led to global disruption to websites, including government websites in France and Finland, and local council websites in the UK,’ said Matt Palmer, director of the Jersey and Guernsey Cyber Security Centres.
‘PHP is a widely-used scripting language used by many websites, as well as website management platforms like WordPress. It’s not something that most users will have heard of, but it’s key infrastructure that underpins the websites we use every day.
‘This incident has happened because a weakness in PHP allowed attackers to access website servers and potentially steal information.
‘This could include contact details, personal information, and banking details.
‘Because this is such a serious risk, we saw many organisations take down their website to fix the vulnerability before it could be exploited.
'This is what led to the disruption of many websites.
‘This vulnerability is a good example of how cutting-edge risks and long-standing issues meet in cyber security. The vulnerability was only found using AI.'
PHP's subsequent release of a programming update patch to fix the vulnerability highlighted an issue regularly raised by the GCSC, he added.
‘Any organisation running a website using PHP should take down the website and apply the patch as a matter of urgency.
‘This is why regular patching is important, and why applying critical patches – like this one – is vital.
‘While the disruption might be frustrating, it’s a sign that organisations are acting responsibly.
‘While it is far from ideal, a quick response benefits us all.’
The government said no large UK public-facing critical services had been affected.
Olly Whitehouse, chief technology officer of the UK’s National Cyber Security Centre, called the event ‘unprecedented’, but said there were no indications of successful breaches by hackers.
But experts admit that they are concerned that any impact from the hacking may take time, even months, to become fully apparent.
You need to be logged in to comment.