Summary

  • Organisations around the world are scrambling to fix a critical cyber-security flaw that could affect millions of websites

  • The vulnerability is within the PHP programming language, which is used to power many platforms. PHP collects information you need and presents it in a way you can read on the web

  • Artificial intelligence identified the issue, prompting warnings from governments and cyber-security agencies to take sites offline

  • "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the UK's National Cyber Security Centre says

  • Among the impacted sites are Wikipedia, Edinburgh council, many online stores and the BBC

Live Reporting

Edited by Kieran Kelly

  1. UK government working to identity any potential exposure

    The exterior of a building viewed from street level shows seven floors of glass frontage.PA Media

    The UK's National Cyber Security Centre headquarters in Victoria, London

    As we reported earlier, the UK government says it is working to identify any potential exposure in its online services.

    A UK government spokesperson urges "all organisations, private and public, large and small" to follow guidance to protect their systems.

    The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia, earlier urged those who use PHP to apply the fixes.

    "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC said in a note.

  2. Researchers used AI to discover decades-old PHP flaws

    The vulnerabilities were found by researchers at the security firms Calif and Wiz.

    The researchers used advanced artificial intelligence (AI) tools that are able to analyse code and find flaws much faster than humans or older systems can.

    "Modern software is incredibly complex, and some vulnerabilities can remain undetected for years," cyber-security researcher Salil Kanhere from UNSW Sydney says.

    "The underlying bugs weren't new; what changed was our ability to find them," he adds.

    Details of the discovery leaked online this week, forcing the PHP platform's developers to rush out its announcement of the security flaw and its huge scale.

    The incident "highlights how AI can uncover security flaws" but also how it can "help attackers rapidly develop offensive tools and exploits," OpenAI - the maker of ChatGPT - says in a blog post.

  3. What is the cyber-security flaw affecting websites around the world?

    A screen displays the unavailable French government website, info.gouv.frReuters

    Government websites are down around the world, including France, due to the exposure

    You may not have heard of PHP - short for PHP: Hypertext Preprocessor - but you almost certainly interact with it daily.

    PHP powers a vast number of platforms, including online shops, Wikipedia and WordPress – the content management system behind many websites like blogs.

    When you visit a website like Wikipedia, PHP is the code that collects information you need and presents it in a way you can read on the web, Paul Spain, chief executive of Gorilla Cyber Security, tells the BBC.

    But due to a flaw that could allow attackers to take control of affected web servers without authentication and steal sensitive data, everything built on PHP was left exposed.

    AI could make such attacks easier and faster, Spain says, estimating that the flaw could affect "millions and millions" of websites.

  4. Governments and companies rush to protect websites after discovery of security flaws

    The website of the Computer Emergency Response Team for the EU Institutions, Bodies and Agencies (CERT-EU) is displayed on a mobile phone in Mierlo, the NetherlandsEPA/Shutterstock

    Governments and some of the world's biggest companies, including Amazon, are rushing to protect their systems after the discovery of critical cyber-security flaws.

    They are present in the PHP programming language that underpins a significant number of websites, with cyber-security firm Wiz estimating that "roughly 70%" of the internet is affected, though the BBC is unable to independently verify that figure.

    Various European nations have shut down some public web services as a precaution, and Wikipedia also took down parts of its website.

    This was in line with advice issued by governments, including the US, to take websites down if the flaws could not immediately be fixed.

    Wiz - one of the companies whose researchers uncovered the vulnerabilities - describes the flaws as the "most severe" ever detected by AI.

    OpenAI, whose technology was used to find the flaws, calls the discovery "one of the most impactful security issues in recent memory".

    The UK government says it is working to identify any potential exposure.

    Stay with us as we bring you the latest developments on this story.