A cyber threat identified by tech researchers has left government bodies and multinationals as large as Amazon scrambling to build defences and stop hundreds of hacking attacks.
The UK government announced that dozens of services had gone offline as a precautionary measure to fend off cyber threats exposed by vulnerabilities in programming languages.
The Office for Budget Responsibility, which is in the process of preparing its crucial fiscal report for the Budget next week, was among those to announce late on Wednesday night that it had taken its website offline following advice from the National Cyber Security Centre. It was back up on Thursday and the body said the Budget had not been “compromised by security issues”.
Scottish Parliament, the Food Standards Agency, Environment Agency, Competition and Markets Authority and Gambling Commission also had websites taken down. Baroness Lloyd of Effra, a digital minister, said a number of government services had been taken down in order to build security across the government.
Details of a solution to patch up software were “mistakenly” leaked online, according to a non-profit group involved in researching PHP, forcing engineers to share warnings publicly over the course of this week. , according to CityAM
The BIRA, has alerted its members and other small businesses to the risk and is advising them to speak to their web developer or hosting provider as a priority.
Andrew Goodacre, CEO of Bira, said:
This is a serious warning and one that independent retailers should not ignore. Many small shops now rely on their website to take orders, show stock and stay in touch with customers, and a large number of those sites run on PHP without the owner ever knowing it. We have said many times that no business is too small to be targeted by cyber criminals, and that is very much the case here.”
Mr Goodacre added: “You do not need to be a technical expert to protect your business. Simply contact whoever built or hosts your website and ask them to confirm that PHP has been updated to the latest fixed version. If your site is running an older version that is no longer supported, now is the time to get it upgraded. It is a quick conversation that could save a great deal of trouble.”
PHP is the technology behind a large share of the world’s websites, including many built on popular platforms such as WordPress and WooCommerce. The PHP Foundation issued an advisory this week warning of two serious vulnerabilities, and fixes are now available. The National Cyber Security Centre (NCSC) is encouraging UK organisations to take immediate action, warning that the flaws may allow attackers to run commands on any web server running PHP.
According to the PHP Foundation, the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older versions no longer receive security updates, so businesses running these are being urged to move to a supported version. The NCSC advises that all versions may be affected and that organisations should not assume they are safe simply because they are running a recent version.
