Numerous websites, including Canadian government sites, experienced downtime on Wednesday to address identified vulnerabilities in PHP, a widely utilized programming language. Developers swiftly issued critical updates to address these vulnerabilities and advised website operators to promptly apply the patches. The PHP Foundation emphasized the importance of immediate updates for all PHP users.
Artificial Intelligence Minister Evan Solomon confirmed that certain federal government websites were temporarily offline as a precautionary measure due to the PHP security issue. Affected organizations running PHP-based websites were urged to implement the necessary security updates promptly. Websites such as the Canadian Centre for Cyber Security and Statistics Canada were inaccessible during the outage.
Additionally, provincial websites for Newfoundland and Labrador, Prince Edward Island, and Elections B.C. were also offline, citing global security concerns as the reason for the downtime. Notable entities like Wikipedia, Cloudflare, and Maple Health also addressed the PHP security vulnerabilities on the same day.
The vulnerability in PHP, a foundational web language dating back to the early 1990s, powers numerous prominent websites like WordPress, Drupal, Joomla, and Magento. With PHP running approximately 75% of identifiable programming language websites, the urgency of applying the fix was stressed by cybersecurity experts. Larger organizations are expected to implement the fix swiftly, while smaller entities may face challenges due to resource limitations.
An Alphabet-owned cybersecurity company, Wiz, discovered the PHP flaw using artificial intelligence, further highlighting the potential risks associated with these vulnerabilities. The PHP Foundation acknowledged delays in addressing the issue due to resource constraints and the complexity of finding effective solutions.
Despite AI aiding in identifying and resolving vulnerabilities, there remains a concern that malicious actors could exploit these weaknesses. The use of AI by cybercriminals to target systems and databases poses a significant threat, potentially leading to an increase in cybersecurity incidents globally. Security agencies worldwide, including those in Europe, Australia, Japan, and Britain, emphasized the criticality of applying the PHP fix to mitigate risks.