UK Government Services Briefly Disrupted by PHP Security Flaw

The UK government took some services offline as a precautionary measure after critical vulnerabilities were discovered in PHP, a programming language used for decades in web development. Developers of PHP announced the security flaws, which researchers warned could expose millions of websites to potential hacks if left unpatched.

Baroness Lloyd of Effra, the UK's tech minister, informed the House of Lords that "some" government services might be temporarily unavailable while security updates were applied. She noted that 32 government services were unavailable and four were partially unavailable, attributing the disruptions to "precautionary measures taken to protect systems." The government stated that no large, public-facing critical services were affected and that work was underway to identify and fix potential exposures, in collaboration with international partners. No successful breaches have been reported.

Olly Whitehouse, chief technology officer at the National Cyber Security Centre (NCSC), described the event as "unprecedented" but confirmed there were no indications of successful hacker breaches. The NCSC is receiving positive confirmation that its advice to affected parties is being acted upon.

Cyber-security lecturer Rory Hopcraft emphasized the need for the government to ensure its own infrastructure is up-to-date, stating that the government should practice what it preaches regarding security. Meanwhile, Dean Presley, a garage owner in South Wales, reported being unable to process MOTs online since Wednesday morning, forcing him to use paper documents and causing customer delays.

PHP, which stands for PHP: Hypertext Preprocessor, is a server-side scripting language that powers a significant portion of the world's websites, including platforms like Wikipedia, online shops, and WordPress. According to the cyber-security firm Wiz, which helped uncover the vulnerabilities, PHP is used by 70% of global websites. The flaws, dubbed "php2shell," are inherent to the language itself and affect many past versions.

The PHP Foundation warned that under the right conditions, an unauthenticated attacker could remotely execute code on servers running PHP. Internet infrastructure firm Cloudflare reported seeing millions of attempts to exploit these vulnerabilities across its network shortly after they were publicly announced. Amazon also reported attempted exploits but stated its websites remained operational.

While many websites were taken offline globally on Wednesday and Thursday as operators rushed to update systems, some, including those of a Dutch cyber-security agency, Finland's government, and parts of Wikipedia, had returned to normal operations by Thursday. Telecommunications company Orange also temporarily suspended access to certain global services while deploying security fixes.

Cyber-security researchers observing server scans indicated that while organizations are implementing patches, the global response rate may not be as rapid as necessary. Matt Hull, VP of cyber intelligence and response at NCC Group, noted that the window for response has shrunk dramatically, with attackers now able to exploit vulnerabilities in days or hours, compared to weeks previously. He also highlighted the potential for burnout among security professionals and stressed the importance of resilience in both technology and people.