Organisations patch PHP flaws as UK government services go offline
Critical flaws were found in PHP, a programming language used by many websites, prompting organisations worldwide to update systems or take some services offline. UK government services were among those affected by precautionary measures, though officials and cyber-security experts said there was no evidence of successful attacks.
The tech minister said 32 government services were unavailable and four partially unavailable; officials said no major public-facing critical services were affected. PHP underpins platforms including WordPress and is estimated by cyber-security firm Wiz to power 70% of the world’s websites. A garage in South Wales also reported disruption to online MOT paperwork, and experts warned the effects of any exploitation could take months to emerge.
In short
- PHP security flaws triggered a global update effort.
- 32 UK government services were unavailable.
- No successful attacks have been reported.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Taking services offline while patching critical PHP flaws can be a prudent precaution: even without evidence of an attack, a vulnerability in widely used software could expose public systems and personal data. Temporary disruption may be justified to reduce that risk, especially if officials judge that essential public-facing services remain available.
The case against
Precautionary shutdowns can impose real costs on people and organisations that rely on online services, as the disruption to MOT paperwork illustrates. Critics could reasonably ask whether each outage was necessary, whether patches and other safeguards could have kept services running, and whether the public received clear information about the scale and duration of disruption.
Explained simply
PHP is a programming language used to build and run many websites. It also supports software such as WordPress, so a problem in PHP can affect organisations that rely on it even if they did not write the software themselves.
The key players include the teams that maintain PHP, organisations that use it, and cyber-security specialists who assess the risks. Government departments and other organisations may temporarily disable services or install updates while they check whether their systems are affected.
The issue matters because flaws in widely used software can have consequences across many services. Those effects can include temporary disruption, while any misuse of a flaw may take time to detect.
Cybersecurity Software Technology World
Read the full article at the source →
Originally published by BBC World as “Race to update services’ computer systems after cyber-security flaw found”.