The Canadian government is temporarily taking down some of its own websites to patch a serious vulnerability in the code that underpins roughly 70 per cent of the world’s websites.
The vulnerabilities, which affect the PHP coding language, sent the cyber security world into a panic Wednesday as governments and businesses braced for a wave of cyber attacks.
PHP is the programming language that runs websites, assembling their content to show to users. The vulnerabilities, which developers have already released a fix for, could allow attackers to steal information, deface or take over websites if not patched.
In a social media post Wednesday, AI Minister Evan Solomon said the government was taking down some of its websites on the advice of the Communications Security Establishment’s cyber security centre.
“This is a global issue, and other governments and organizations are also taking protective measures. If your organization uses PHP, apply the latest security updates as soon as possible and follow (the Canadian Centre for Cyber Security) for updates,” Solomon’s post read.
“We take this situation extremely seriously … Affected websites will be restored once patches are applied.”
What is the PHP coding issue?
The CSE deferred Global News’ questions, including how many government websites were affected and what measures were being taken to address the issue, to Treasury Board. The Treasury Board did not immediately respond to those questions.
The Cyber Centre issued detailed guidance Wednesday, which included immediately patching any PHP installations, identifying third-party products that use PHP and ensure they’re updated, and, when an immediate fix is not available, take down the internet-facing applications from public networks.
The vulnerabilities were publicly disclosed by two security companies: Calif, which worked with OpenAI, and Wiz, a firm owned by Google, using AI models. The two companies independently identified vulnerabilities in August, but they were only widely publicized on Wednesday.
The flaws in PHP left millions of servers across the world vulnerable to compromise all at once. Cybersecurity firms said the attacks could take the form of stolen data, defaced websites up to a full compromise of a system. By Wednesday morning, Cloudflare’s chief technology officer said evidence of early attacks was already emerging.
“It is a big deal, certainly because of the ubiquity of this technology. It’s been around since 1995, almost since the birth of the internet,” said Jason Gallaugher, the Canadian Internet Registration Authority’s (CIRA) chief technology and security officer, in an interview with Global News.
Gallaugher said that international oversight and cyber security authorities have urged websites to patch the problem immediately, but given how widespread the PHP code has been deployed, that’s proven more difficult for some.
“If for whatever reason within that website it can’t be done immediately, and there are a lot of reasons for that, than their recommendation to mitigate the risk is to pull that website offline,” Gallaugher said.
Gallaugher said most Canadian internet users may not be directly affected, and unless they also operate a website, don’t need to take additional security measures as a result of the PHP exploit.
But Canadian companies, including small businesses, need to make sure they have “access to the right people and expertise” to respond quickly to these kind of events, Gallaugher said.
“This isn’t something that companies, in particular, even small business owners can think about only when something goes wrong, or we see a very noisy incident like we have in the last 48 hours,” Gallaugher said.
With files from Reuters.