×
Tech

Websites taken down worldwide as critical cyber-security update issued

Websites taken down worldwide as critical PHP cyber-security update issued

Other websites, including the art platform DeviantArt, have said they are "temporarily down for maintenance, external" without specifying the reason.

The vulnerabilities were discovered by cyber-security researchers at the firms Calif and Wiz.

Calif, along with PHP Foundation, were part of a program started by OpenAI called Patch the Planet.

Through that program, they were given access to the AI company's advanced AI tools in order to find and fix flaws in web development language.

OpenAI said in a blog post, external that the discovery was "one of the most impactful security issues in recent memory". It added an internal researcher at the company had also discovered the issue around the same time as the other firms.

The flaws had gone undetected for more than a decade. By August, after a few weeks of using advanced AI tools, they were discovered.

"Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours," Wiz said in a blog post.

It has estimated "roughly 70%" of the internet is affected, though the BBC is unable to verify that figure.

While PHP Foundation intended to release its discovery later this month along with a complete fix for the problem, usually referred to by software developers as a "patch," details of the flaw were leaked on social media on Tuesday.

It forced PHP Foundation to rush out its announcement of the vulnerability and its huge scale.

The Netherlands' National Institute for Public Health and the Environment, an agency of the Dutch government, has taken down its website.

Similarly the website of the Tweede Kamer, the lower house of the nation's parliament, has become inaccessible.

The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia have urged those who use PHP to apply the fixes.

"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC said in a note, external.

Japan's national cyber-security office and EU cyber-security officials have issued a similar warning, external.

Web hosting by Somee.com