Business · NY Digital
UK government working to identity any potential exposure published at 07:30 BST Image source, PA Media Image caption, The UK's National Cyber Security Centre headquarters in Victoria, London As we reported earlier, the UK government says it is working to identify any potential exposure in its online services. A UK government spokesperson urges "all organisations, private and public, large and small" to follow guidance to protect their systems. The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia, earlier urged those who use PHP to apply the fixes.
"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC said in a note. Researchers used AI to discover decades-old PHP flaws published at 07:20 BST The vulnerabilities were found by researchers at the security firms Calif and Wiz. The researchers used advanced artificial intelligence (AI) tools that are able to analyse code and find flaws much faster than humans or older systems can.
"Modern software is incredibly complex, and some vulnerabilities can remain undetected for years," cyber-security researcher Salil Kanhere from UNSW Sydney says. "The underlying bugs weren't new; what changed was our ability to find them," he adds. Details of the discovery leaked online this week, forcing the PHP platform's developers to rush out its announcement of the security flaw and its huge scale.
The incident "highlights how AI can uncover security flaws" but also how it can "help attackers rapidly develop offensive tools and exploits," OpenAI - the maker of ChatGPT - says in a blog post. What is the cyber-security flaw affecting websites around the world? published at 07:18 BST Image source, Reuters Image caption, Government websites are down around the world, including France, due to the exposure You may not have heard of PHP - short for PHP: Hypertext Preprocessor - but you almost certainly interact with it daily. PHP powers a vast number of platforms, including online shops, Wikipedia and WordPress – the content management system behind many websites like blogs.
When you visit a website like Wikipedia, PHP is the code that collects information you need and presents it in a way you can read on the web, Paul Spain, chief executive of Gorilla Cyber Security, tells the BBC. But due to a flaw that could allow attackers to take control of affected web servers without authentication and steal sensitive data, everything built on PHP was left exposed. AI could make such attacks easier and faster, Spain says, estimating that the flaw could affect "millions and millions" of websites.
Governments and companies rush to protect websites after discovery of security flaws published at 07:15 BST Image source, EPA/Shutterstock Governments and some of the world's biggest companies, including Amazon, are rushing to protect their systems after the discovery of critical cyber-security flaws. They are present in the PHP programming language that underpins a significant number of websites, with cyber-security firm Wiz estimating that "roughly 70%" of the internet is affected, though the BBC is unable to independently verify that figure. Various European nations have shut down some public web services as a precaution, and Wikipedia also took down parts of its website.
This was in line with advice issued by governments, including the US, to take websites down if the flaws could not immediately be fixed. Wiz - one of the companies whose researchers uncovered the vulnerabilities - describes the flaws as the "most severe" ever detected by AI. OpenAI, whose technology was used to find the flaws, calls the discovery "one of the most impactful security issues in recent memory".
The UK government says it is working to identify any potential exposure. Stay with us as we bring you the latest developments on this story.
Source: BBC
