A cybersecurity official has said there is no evidence that hackers have successfully exploited a major flaw in the PHP programming language, despite the temporary shutdown of 32 government websites as authorities worked to secure affected systems.
The official warned that similar incidents could happen again as organizations continue to face security risks linked to software vulnerabilities.
The flaw was identified months ago, and the National Cyber Security Centre (NCSC) had been working to alert affected organizations through a coordinated disclosure process, allowing them time to address the issue before details became public.
However, a leak forced the agency to speed up the disclosure process, prompting a more urgent response from organizations using the affected technology.
The vulnerability has raised concerns because PHP is widely used to build and operate websites, making security weaknesses in the programming language a potential risk for a large number of online services.
Although no successful attacks linked to the flaw had been identified, cybersecurity experts have stressed the importance of applying security updates promptly to reduce the risk of exploitation.
The incident has also highlighted the challenges facing governments and businesses as they work to protect computer systems against vulnerabilities that could disrupt services or expose sensitive information.
What is PHP, and why is the security flaw causing concern?
The PHP vulnerability is considered serious because it could allow hackers to take control of affected servers, access sensitive information and disrupt online services. Depending on the system, attackers could potentially steal customer data, expose passwords or cause websites to stop working.
The risk is significant because PHP powers a large proportion of websites worldwide, including those built with popular platforms such as WordPress and Drupal. However, this does not mean that 70 per cent of websites have been hacked or are necessarily vulnerable. The level of risk depends on the PHP version in use, the system’s configuration and whether the necessary security updates have been installed.
Artificial intelligence played a key role in helping researchers identify the vulnerabilities and demonstrate how they could be exploited. The development highlights how AI can accelerate cybersecurity research, but also raises concerns that similar tools could help malicious actors discover and exploit weaknesses more quickly.
Despite the severity of the flaws, the cybersecurity official said there were no indications that hackers had successfully used them to breach government computer systems at the time of the report. However, security experts have urged organisations to install the available patches promptly to reduce the risk of attacks.
The incident underscores the importance of addressing software vulnerabilities before they are exploited, particularly in systems that support essential public services, business operations and the handling of sensitive information.
