Global government websites experience outages as PHP weaknesses are exploited

Government websites across Europe and other regions suffered outages starting on 22 October due to identified weaknesses in PHP. Artificial intelligence has contributed to a year-on-year doubling in the number of discovered digital flaws.

Matthew Prince of VulnCheck, a threat intelligence firm based in Massachusetts, said, "I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling." Security researchers also reported vulnerabilities in Node.js and Plex, while breaches were linked to the development platform Railway and the AI gateway LiteLLM.

The Indian certificate authority eMudhra was found to have used a flimsy cryptographic key. Shane Fry noted that the fundamental change involves the timescale for finding vulnerabilities and how quickly adversaries can weaponise them.

Hunt.io observed aggressive attempts to exploit the PHP bug, though Esteban Borges tracked no cybercriminals had assembled a working tool for the flaw as of 14:00 GMT on 23 October. Ramy Rahman stated that more disclosed vulnerabilities do not automatically mean more successful attacks.

Prince added, "The reality is, we’re going to get a lot of this stuff cleaned up."

Shane Fry said, "What's fundamentally, and unquestionably, changing is the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponise them."

Shane Fry