Websites go dark worldwide after critical flaws are exposed
An urgent warning has been issued to millions after a software used by more than half of the world's websites was found to have critical flaws that could let hackers take over servers.
TL;DR
- Two critical security flaws were discovered in PHP, software powering a significant portion of global websites.
- The US National Security Agency (NSA) advised organizations to prepare for emergency updates and take affected systems offline.
- Websites in Europe and Japan experienced temporary shutdowns, and the Wikimedia Foundation took some systems offline as a precaution.
- Hackers could potentially exploit these flaws to take control of servers without passwords, steal data, or use sites to attack visitors.
- There is a race to patch systems before hackers can use AI to analyze updates and develop exploits.
- PHP is fundamental to many popular platforms like WordPress, Drupal, Joomla, and Magento.
- Both flaws relate to how PHP manages server memory.
- AI-assisted hacking could amplify the threat, enabling large-scale, instant exploitation.
- Patches were reportedly released by the PHP security team.
- CERT-EU recommended isolating internet-facing applications until fixes are applied.
- Reports of active exploitation have emerged, with companies like Cloudflare observing early attacks.