Race to update services' computer systems after cyber-security flaw found

ByTom Gerken and Liv McMahon, Technology reporters.

Key points

• "The information I have is that 32 Government services are unavailable and four are partially unavailable, " tech minister Baroness Lloyd of Effra informed the House of Lords.
• Dean Presley, who has a garage in Chepstow, South Wales, informed BBC Your Voice he had been unable to properly process MOTs online.
• Olly Whitehouse, chief technology officer of the National Cyber Security Centre (NCSC), called the event "unprecedented".
• The website of a Dutch agency specialising in cyber-security, Finland's administration and parts of Wikipedia, taken temporarily offline, had returned to business as usual by Thursday.
• "It will be universally felt, I suspect, " he informed BBC Radio 4's World At One.

Organisations and businesses are still scrambling to update their systems after cyber-security flaws were made public in a widely-used programming language, PHP.

Websites worldwide were taken offline on Wednesday and Thursday after the developers of PHP remarked "critical vulnerabilities" were identified in the back-end language, applied in web development for decades.

Researchers cautioned the "severe" flaws could expose millions of sites using it to potential hacks if left unpatched – and the UK administration was among those to take some sites offline as a precaution.

There have been no successful attacks documented so far, but experts say any impact may take time – even months – to become fully apparent.

Downing Street remarked on Thursday "some" limited government services "may be offline" while security work was being carried out.

She attributed this to having "largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied".

For context, the administration did not specify which services were taken offline – but it stated no sizeable UK public-facing critical services had been affected.

In practice, a spokesperson remarked work had already taken place throughout administration to "identify and fix potential exposures to our systems and our experts are continuing to work closely with both OpenAI and international partners on this issue".

"But this does not mean they were hacked, and work continues to resolve any issues, " they continued.

But he remarked there were "no indications" of any successful breaches by hackers.

He remarked the NCSC was "starting to see positive confirmation" that advice sent to those affected, external had been received and was being acted on. Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb.

What is PHP and why did it spark a global cyber-security scramble?

Cyber-security lecturer Rory Hopcraft informed the BBC the administration needed to create sure that its own infrastructure was up-to-date. "Hacking has been around for many years, " he remarked.

"The government are the ones who set the rules for other organisations. They just need to effectively be practising what they're preaching at this point."

He remarked his computer system had been down since Wednesday morning, and while he has experienced outages before, they have not lasted this long.

"MOTs can be conducted and they're legal but none of the paperwork and certificates can be printed and they're not on the system, " Dean remarked.

He remarked this has forced him to write everything on paper documents, leading to delays for customers. PHP stands for PHP: Hypertext Preprocessor.

It's a programming language which runs on a web server, behind the scenes of a website, and effectively lets you see the sites you visit.

When you go to a site, PHP is the code which collects data and effectively turns it into a page you can read.

It was developed in the early 1990s to support serve dynamic web pages and applications, but still powers lots of platforms today.

PHP has been applied throughout a broad set of platforms including Wikipedia, online shops and WordPress – the system behind plenty of websites – as well as to write tools to build web apps, with Laravel, Symfony and Drupal among popular PHP frameworks.

According to cyber-security firm Wiz, external. It supported uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world's websites.

And it remarked the flaws – now coined "php2shell" – were inherent in the language itself, affecting numerous past versions of it.

For context, the PHP Foundation, the non-profit which maintains the programming language, cautioned this meant that, under the right conditions, an unauthenticated attacker would be able to remotely execute code on servers running PHP.

Some sizeable organisations stated they had seen a high volume of attempts to breach their systems.

Matthew Prince, the boss of internet infrastructure firm Cloudflare, wrote on X, external on Thursday that the firm saw "thousands" of attempts to exploit the PHP vulnerabilities throughout its network in the 10 hours before it was publicly confirmed.

"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now, " he continued.

Amazon additionally states it saw hackers attempt to exploit the flaws, but its websites were operating as normal.

While the impact of the PHP flaw remains to be seen, disruption continued for businesses and organisations after plenty of sites were taken down on Wednesday.

Notably, the website of a Dutch agency specialising in cyber-security, Finland's administration and parts of Wikipedia, taken temporarily offline, had returned to business as usual by Thursday.

As operators rushed to check if PHP might be running within their systems or if any patches were required, but a number of sites appeared to have been taken offline on Thursday.

In France, telecommunications firm Orange additionally noted, external it had suspended access to certain services globally while it deployed security fixes.

According to some cyber-security researchers using scans to check servers at risk of the PHP vulnerability, the rate of organisations implementing patches – but not as rapidly as might be hoped globally.

"The window to respond has shrunk dramatically, " remarked Matt Hull, VP of cyber intelligence and response at global cyber security business NCC Group.

"A few years ago, attackers might have taken weeks to exploit a vulnerability. Now, it can be days or hours."

Taken together, the developments around race to update services' computer systems after cyber point to a situation that is still moving, and the coming days should bring more clarity.