Security gap in programming language: Some websites are still offline

afp/dpa | After a serious security vulnerability in the web programming language PHP became known, government authorities and companies worldwide shut down numerous websites as a precaution. In Europe, websites in Germany, France, the Netherlands and Belgium, among others, were affected on Wednesday. The US secret service National Security Agency (NSA) and the Federal Office for Information Security (BSI) in Bonn urgently recommended this step because of the risk of cyber attacks. They also recommended “immediate” installation of a security update. BSI Vice President Thomas Caspers also warned users about compromised websites.

The vulnerability could allow hackers to gain “direct access” to data systems or server databases, the NSA warned. “Critical vulnerabilities within the PHP programming language are currently threatening web applications worldwide,” explained the BSI.

The security update was made available on Wednesday. If this does not succeed, the websites should be shut down as a precaution, advised the NSA and BSI. Otherwise, cyber attackers could take over servers without a password.

PHP is a programming language used worldwide in building websites and web applications. According to the BSI, all versions up to at least PHP 5 are probably affected. “If you are using PHP, it is imperative that you update now,” the PHP Foundation said in a blog post.

Only websites that run PHP on their own servers are affected. Many large platforms are based on other programming languages ​​or have operators who were able to apply the security update quickly so that they could remain online.

In Germany, state and police authorities as well as several cities took their offers offline as a precautionary measure on Wednesday in order to upload updates.

In the morning, some offers were activated again, including many websites in Rhineland-Palatinate and Saarland. In Thuringia, too, many sites have been online again since late Wednesday evening, including those of the State Chancellery, the State Police and the Ministry of the Interior.

According to authorities, several online police services in North Rhine-Westphalia were also online again. “After intensive work, the sites were able to be put back into operation,” said the State Office for Central Police Services. However, other prominent websites in North Rhine-Westphalia were also not accessible today.

The Berlin police reported failures of the “Internet Guard”, through which reports can be made, and referred to the emergency number 110. The Berlin Charité University Hospital was also affected. In addition, numerous cities temporarily took their online offerings offline, including Munich, Flensburg and Saarbrücken.

In France, the websites of several authorities, including the Paris police, were no longer accessible. In Belgium, among other things, the Foreign Ministry website was offline. In the Netherlands, the digital identity service DigiD, the parliamentary website and the national cybersecurity center website were affected.

In Australia, the Australian Signals Directorate announced, according to the Australian public broadcaster ABC, that its own website cyber.gov.au was among the government websites affected by the security gaps. According to the Wikimedia Foundation, the online encyclopedia Wikipedia it operates was also affected, so users should expect outages.

As the gaming news portal Kotaku reported, several apps from the successful Pokémon games were also taken offline on Wednesday. In one case, security measures were cited as the reason.

The vulnerabilities were reported in August by security firm Calif and ChatGPT developer OpenAI, who independently discovered them on the same day. Wiz later reported other ways to exploit them.

According to Wiz estimates, around 70 percent of the world's websites are based on PHP. The company called the vulnerabilities "one of the most serious vulnerabilities ever discovered in PHP - and possibly in the entire history of software."

The vulnerabilities were initially reported confidentially to the PHP developers and remained secret while a solution was worked on. Details were leaked online on Tuesday - a day before the update was scheduled to release. This led to the precautionary shutdown of many websites.

According to BSI Vice President Thomas Caspers, “up to now it has not been observed that any major damaging effects have occurred.” “However, anyone who does not patch their web applications today and install the latest version runs the real risk of being affected at very short notice,” said Caspers on Wednesday evening in the ARD “Tagesthemen” with a view to updating the security updates. It can be assumed that not all operators installed the updates. “Then we will also see the first damage.”

“If you don’t patch your web applications today and install the latest version, you really run the risk of being affected at very short notice,” he warned. According to Caspers, users are initially not affected. However, consumers should pay attention “and also expect” that in the next few days attempts could be made to install “malicious material on their systems” via potentially compromised websites.

At the same time, AI expert Ethan Mollick from the US elite university University of Pennsylvania warned that companies were struggling to keep up with the pace of updates needed to protect against AI-based cyberattacks. Consumers would now also experience “that everything is updated frequently and quickly,” he wrote on X.