Why Websites Went Down This Week: The PHP Security Alert
On Wednesday, websites around the world started going offline. Finland temporarily shut down its government's public web services, the Netherlands' cyber-security agency took its own website offline, and some people couldn't reach parts of Wikipedia.
Many of these sites were switched off on purpose, as a precaution against a serious security flaw.
What happened?
Most websites rely on a behind-the-scenes technology called PHP to build the pages you see. Think of it as the kitchen staff in a restaurant: you never see them, but they make every meal. PHP powers popular tools like WordPress.
Researchers found two critical flaws in PHP. In simple terms, these flaws could let a stranger anywhere in the world take control of a website's computer without needing a password. From there, an attacker could reach files and user information, or knock the site offline.
How big is it?
- Security firm Wiz estimates "roughly 70%" of the internet is affected. The BBC couldn't confirm this figure.
- The flaws went unnoticed for more than ten years
- The UK, US, EU, Australia and Japan have all issued warnings.
The flaws were found with the help of artificial intelligence, in just a few weeks.
Is there a fix?
Yes. The PHP team released a fix on 21 October. The UK's National Cyber Security Centre advises organisations to update straight away, or to take their sites offline until they can. That's why so many websites went dark.
What should you do?
If you use websites:
- You don't need to install anything. The problem is on website servers, not on your phone or computer.
- If a site is down, be patient. It's probably being fixed.
- Watch out for scams. Don't click links in messages saying "your account was affected". Type the website address yourself instead.
What about PUT-IT-ON?
PUT-IT-ON also uses PHP behind the scenes. Our team has already upgraded to the fixed version, so there's nothing you need to do. You can keep using PUT-IT-ON as normal.
The bottom line
This is a serious problem, but a fix already exists and people are acting fast. Most of the outages you're seeing are websites doing the right thing.
Sources
- NCSC
- BBC News
