Numerous websites, including those of the Canadian government, experienced downtime on Wednesday to address security flaws identified in PHP, a widely utilized programming language. PHP developers issued critical updates to address the vulnerabilities and urged website administrators to promptly apply the fixes. The PHP Foundation emphasized the importance of updating PHP immediately in a press release.
Artificial Intelligence Minister Evan Solomon disclosed that certain federal government websites were temporarily taken offline as a precautionary measure due to the PHP vulnerabilities. Solomon emphasized the need for organizations running PHP-based websites to implement the security updates swiftly. Affected websites will be restored once the necessary fixes are in place.
During the downtime, websites such as the Canadian Centre for Cyber Security and Statistics Canada were inaccessible. Provincial websites for Newfoundland and Labrador and Prince Edward Island also displayed messages attributing the shutdown to a global security incident. Elections B.C.’s website was offline on the final day of advance voting before the provincial election.
Wikipedia, Cloudflare, and Maple Health also addressed PHP security vulnerabilities on Wednesday. PHP, originally known as “Personal Home Page,” is a foundational programming language for websites like WordPress, Drupal, Joomla, and Magento. It powers a significant portion of the public internet and is maintained by volunteers as free, open-source software.
According to web technology tracker W3Techs, PHP is utilized in approximately 75% of websites with identifiable programming languages. Ritesh Kotak, a cybersecurity analyst in Toronto, highlighted the critical role PHP plays in internet infrastructure and the potential risks posed by unpatched vulnerabilities. Larger organizations are expected to implement fixes swiftly, while smaller entities may face challenges due to resource limitations.
The cybersecurity company Wiz, an Alphabet subsidiary, identified the PHP vulnerability using artificial intelligence. The flaw had existed for over a decade, and extensive efforts were made to validate the patch and collaborate with industry partners for a coordinated rollout. The PHP Foundation acknowledged delays in addressing the vulnerability due to resource constraints and prioritization of other issues.
Kotak emphasized the dual nature of AI in cybersecurity, noting its role in both identifying and exploiting vulnerabilities. He warned of the possibility of increased cyber incidents facilitated by AI tools and techniques. Globally, cybersecurity agencies and governments, including those in Europe, Australia, Japan, and Britain, called on PHP users to apply the necessary fixes. Some European countries proactively took their websites offline to address the PHP vulnerabilities.