Panic arose in the US, Europe, and several other countries due to the discovery of a vulnerability. On Wednesday, many governments decided to temporarily shut down their websites. Furthermore, the US National Security Agency (NSA) issued a corresponding warning.
The core issue is that two serious vulnerabilities were identified in the PHP programming language. This prompted countries, including the US and Europe, as well as various companies, to take measures to protect their web resources. Nevertheless, the company has already released an updated version that fixes this bug.
What is PHP? PHP is a programming language primarily used for creating web applications and sites. It is responsible for processing data from elements such as forms, user accounts, and authorization on web resources. Most internet sites and web applications use PHP.
The US NSA advised all companies and organizations using PHP to immediately install the new update. If prompt updating is not possible, it is recommended to take the website system offline. In its message, the NSA indicated that PHP is widely used in both large websites and mobile applications. These vulnerabilities allow attackers direct access to the file system and database.
The PHP Foundation, which develops and supports PHP, acknowledged this problem as a structural failure. The Foundation reported that the new release corrects two critical vulnerabilities. These flaws could have allowed hackers to exploit the system and execute code without needing to log in.
OpenAI, the creator of ChatGPT, stated that this is one of the most significant vulnerabilities to date. The company announced via the X platform that its artificial intelligence model helped researchers discover these flaws in the PHP model.
Due to the two vulnerabilities found in PHP, numerous local government portals in France were disabled on Wednesday, including the Police Prefecture website. Similarly, Dutch authorities temporarily suspended the operation of several government websites as a precaution. Among these resources were the DigiD Digital Identity Service, the Chamber of Deputies website, and the National Cyber Security Centre.
The Ministry of Foreign Affairs of Belgium also decided to temporarily close its official website. However, Belgian cybersecurity later stated that no signs of an attack on the Belgian website were detected.