Cyber security chiefs have warned UK organisations their websites may have to be taken offline, after a researcher using AI discovered a “critical security issue” in a programming language.
uncertain
researcher → warn → language
The Finnish government’s website was one of several to be partly disabled because of the incident on Wednesday, along with the websites of several local authorities in the UK.
asserted
website → disable → UK
The Office for Budget Responsibility said it had followed guidance to take its website offline, “in view of the critical security issues affecting PHP”.
asserted
it → say → PHP
It is understood some of the Government’s online services may be temporarily unavailable while steps are taken to maintain security, but any impact is expected to be minimal.
uncertain
impact → understand → security
No large public-facing critical services are thought to have been affected.
asserted
services → face → ?
The security issue identified by the researcher could allow attackers to remotely control any web servers running the widely used programming language, PHP.
uncertain
attackers → identify → language
According to Cloudflare chief executive Matthew Prince, there was a dramatic surge in attempts to exploit the issue once it was announced.
uncertain
it → accord → issue
He wrote on X: “Some stats on #php2shell.
asserted
He → write → php2shell
In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it.
asserted
we → announce → it
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
asserted
That → jump → hours
Organisations have been urged by the National Cyber Security Centre (NCSC) to update to a new, fixed version of the software.
asserted
Organisations → urge → software
Read More
If software cannot be immediately upgraded, organisations should consider taking their websites offline, the NCSC said.
asserted
NCSC → read → websites
“We encourage all organisations, private and public, large and small, to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems.”
asserted
We → encourage → systems
The cyber division of the National Security Agency in the US warned weaknesses in the software could provide “a direct path to the server’s file system or database”.
uncertain
weaknesses → warn → system
The Wall Street Journal reported that the flaw was discovered in August by Ryan Austin, a researcher at the cybersecurity company Calif, using an advanced AI model developed by OpenAI.
asserted
flaw → report → OpenAI
PHP developers had reportedly planned a security update on Thursday, but the release was brought forward after details of its work to address the vulnerabilities leaked online.
uncertain
details → plan → vulnerabilities
OpenAI, which runs ChatGPT, said in the past two months it has been leading a team of researchers working to address the critical flaw in PHP, and supported its developers as it led the fixes.
asserted
it → run → fixes
All that sort of scamming and fraud and so forth gets turbochargedAll that sort of scamming and fraud and so forth gets turbocharged
The company described the incident as “one of the most impactful security issues in recent memory”, adding that while AI can help to uncover issues, it can also aid attackers.
asserted
it → turbochargedAll → attackers
“To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a defender’s window for maintainers and security providers to prepare fixes and protections ahead of disclosure,” it said.
asserted
it → find → disclosure
Former head of the NCSC, Ciaran Martin, told Times Radio the vulnerabilities in PHP had the potential to create a significant loss of personal data.
asserted
vulnerabilities → tell → data
He said: “You’re talking about the potential to take the personal details of cards, including those crucial three digits on the back and so forth, so people will want to be on the alert for scams in future.
“
asserted
people → say → future
You’re talking potentially for ransomware attackers, not to be able to do ransomware directly as a result of this, but to get a foothold into the organisation.
asserted
You → talk → organisation
“You’re talking about easier to impersonate CEOs because you get to know them better.
asserted
you → talk → them
All that sort of scamming and fraud and so forth gets turbocharged.”
asserted
sort → turbocharge → scamming
The Aporia
