Race to update services' computer systems after cyber-security flaw found

Organisations and businesses are still scrambling to update their systems after cyber-security flaws were revealed in a widely-used programming language, PHP.

1. Zoe Kleinman: PHP é o equivalente cibernético de uma bomba não detonada Publicado há 7 horas.
2. UK working to identify exposure after global cyber-security warningPublished8 hours ago.
3. What is PHP and why did it spark a global cyber-security scramble.

Legenda da figura, Como a IA descobriu o enorme risco de cibersegurança da internet.

Websites around the world were taken offline on Wednesday and Thursday after the developers of PHP said "critical vulnerabilities" were found in the back-end language, used in web development for decades.

Researchers warned the "severe" flaws could expose millions of sites using it to potential hacks if left unpatched - and the UK government was among those to take some sites offline as a precaution.

Não houve ataques bem-sucedidos relatados até agora, mas especialistas dizem que qualquer impacto pode levar tempo — até mesmo meses — para se tornar totalmente aparente.

Downing Street said on Thursday "some" limited government services "may be offline" while security work was being carried out.

A informação que tenho é de que 32 serviços do governo estão indisponíveis e quatro estão parcialmente indisponíveis," disse a ministra de Tecnologia, Baronesa Lloyd de Effra, à Câmara dos Lordes.

She attributed this to having "largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied.

The government did not specify which services were taken offline - but it said no large UK public-facing critical services had been affected.

A spokesperson said work had already taken place across government to "identify and fix potential exposures to our systems and our experts are continuing to work closely with both OpenAI and international partners on this issue.

But this does not mean they were hacked, and work continues to resolve any issues," they added.

Olly Whitehouse, diretor de tecnologia do National Cyber Security Centre (NCSC), chamou o evento de “inédito”.

It will be universally felt, I suspect," he told BBC Radio 4's World At One.

But he said there were "no indications" of any successful breaches by hackers.

Ele disse que o NCSC estava “começando a ver confirmação positiva” de que o conselho enviado aos afetados, externo, havia sido recebido e estava sendo atendido.

Cyber-security lecturer Rory Hopcraft told the BBC the government needed to make sure that its own infrastructure was up-to-date.

Hacking tem sido uma prática há muitos anos," ele disse.

O governo são os responsáveis por estabelecer as regras para outras organizações... eles simplesmente precisam estar praticando o que pregam neste momento.

Dean Presley, who has a garage in Chepstow, South Wales, told BBC Your Voice he had been unable to properly process MOTs online.

He said his computer system had been down since Wednesday morning, and while he has experienced outages before, they have not lasted this long.

MOTs can be conducted and they're legal but none of the paperwork and certificates can be printed and they're not on the system," Dean said.

Ele disse que isso o forçou a escrever tudo em documentos em papel, causando atrasos para os clientes.

PHP stands for PHP: Hypertext Preprocessor.

É uma linguagem de programação que roda em um servidor web, nos bastidores de um site, e efetivamente permite que você veja os sites que visita.

When you go to a site, PHP is the code which collects data and effectively turns it into a page you can read.

It was developed in the early 1990s to help serve dynamic web pages and applications, but still powers lots of platforms today.

PHP tem sido usado em uma ampla variedade de plataformas, incluindo Wikipedia, lojas online e WordPress – o sistema por trás de muitos sites – bem como para escrever ferramentas que constroem aplicativos web, com Laravel, Symfony e Drupal entre os frameworks PHP mais populares.

According to cyber-security firm Wiz, external, which helped uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world's websites.

And it said the flaws - now coined "php2shell" - were inherent in the language itself, affecting many past versions of it.

The PHP Foundation, the non-profit which maintains the programming language, warned this meant that, under the right conditions, an unauthenticated attacker would be able to remotely execute code on servers running PHP.

Algumas grandes organizações disseram ter observado um alto volume de tentativas de violar seus sistemas.

Matthew Prince, o chefe da empresa de infraestrutura de internet Cloudflare, escreveu no X, externo, na quinta‑feira, que a empresa viu “milhares” de tentativas de explorar as vulnerabilidades PHP em toda a sua rede nas 10 horas antes de ser anunciada publicamente.

That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now," he added.

Amazon also says it saw hackers attempt to exploit the flaws, but its websites were operating as normal.

Image source, Getty ImagesImage caption, Cyber researchers at Calif and Wiz unearthed the php2shell flaw, theorised by the PHP Foundation in 2024, in part using OpenAI tools.

Enquanto o impacto da falha PHP permanece a ser visto, a interrupção continuou para empresas e organizações depois que muitos sites foram derrubados na quarta-feira.

The website of a Dutch agency specialising in cyber-security, Finland's government and parts of Wikipedia, taken temporarily offline, had returned to business as usual by Thursday.

But a number of sites appeared to have been taken offline on Thursday, as operators rushed to check if PHP might be running within their systems or if any patches were required.

In France, telecommunications company Orange also said, external it had suspended access to certain services globally while it deployed security fixes.

According to some cyber-security researchers using scans to check servers at risk of the PHP vulnerability, the rate of organisations implementing patches - but not as quickly as might be hoped globally.

A janela de resposta diminuiu drasticamente," disse Matt Hull, vice‑presidente de inteligência e resposta cibernética na empresa global de segurança cibernética NCC Group.

Há alguns anos, os atacantes poderiam levar semanas para explorar uma vulnerabilidade. Agora, isso pode levar dias ou horas.

Hull also highlighted the extent of the task facing developers and engineers working to deal with the issue.

Several days into this incident, security professionals might already be dealing with significant burnout," he said, urging a need to "make time to rest, share the workload and look after each other.

Resilience depends on people as much as technology.