Numerous online platforms, including websites managed by the Canadian government, experienced downtime on Wednesday to address security flaws discovered in PHP, a widely utilized coding language.
On Wednesday, PHP developers swiftly released critical updates to address vulnerabilities in their software, urging website administrators to promptly implement the patches.
The PHP Foundation emphasized the urgent need for PHP users to update their systems immediately to mitigate potential security risks.
Canadian Artificial Intelligence Minister Evan Solomon confirmed that certain federal government websites were temporarily offline as a precautionary measure, stressing the importance for organizations running PHP-based websites to apply the security fixes promptly.
Notably, websites for the Canadian Centre for Cyber Security and Statistics Canada were inaccessible for a period when attempted to be accessed by CBC News on Wednesday.
Additionally, provincial websites for Newfoundland and Labrador and Prince Edward Island were offline, attributing the shutdown to a global cybersecurity incident. Elections B.C.’s website was also down on Wednesday, coinciding with the final day of advance voting before the provincial election on Saturday.
Wikipedia, Cloudflare, and Maple Health were among the entities that acknowledged and addressed PHP security vulnerabilities on the same day.
The discovery of the PHP vulnerability was facilitated by artificial intelligence, shedding light on the language’s enduring significance in powering major web platforms like WordPress, Drupal, Joomla, and Magento.
PHP remains a cornerstone of the internet, driving approximately 75% of identified programming language-based websites, as reported by web technology tracker W3Techs.
Cybersecurity expert Ritesh Kotak underscored the vulnerability of websites until the necessary updates are applied, particularly noting the challenges faced by smaller organizations with limited resources in promptly implementing the fixes.
Moreover, Alphabet-owned cybersecurity firm Wiz detailed its AI-powered identification of the PHP flaw, which had persisted for over a decade, necessitating collaboration with various industry stakeholders to swiftly deploy the patch.
Despite the role of AI in enhancing cybersecurity, Kotak cautioned about the potential misuse of AI by malicious actors to exploit system vulnerabilities, potentially leading to an increase in cybersecurity breaches.
In response to the global PHP security issue, cybersecurity agencies in Europe, Australia, Japan, and Britain echoed the call for PHP users to promptly address the vulnerabilities, with proactive measures observed in countries like France and the Netherlands where government websites were temporarily taken offline for patching.