Warning for NZ as websites go dark around world in security scare

New Zealand's National Cybersecurity Centre says it's aware of a website security scare that has led to the shutdown of government websites around the world.

The websites in Europe and elsewhere went offline on Thursday (NZT) after the disclosure of critical vulnerabilities in a widely used programming language sent operators around the world scrambling to protect their language systems, Reuters reported.

Developers of the PHP programming language on Thursday (NZT) released urgent new fixes to vulnerabilities that had quietly been lurking in their software for years until they were uncovered using AI, saying that all users were "encouraged to update immediately."

With tech firms warning some hackers were already exploiting the flaws, government agencies across Europe were among those that took sites offline as a precaution.

Because a fix is now public and artificial intelligence tools are able to reverse engineer the bug with little effort, experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of the updates.

AI was powering a "race to exploit," said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black. He said the step was the "mass compromise of every vulnerable web server on the internet."

The National Cyber Security centre was encouraging New Zealand organisations to apply the recommended fix as soon as possible after the flaws in websites using the PHP programming language were exposed on Thursday (NZT).

The centre was also urging organisations to investigate unauthorised access, or compromise, of the kind of commonly used website or web application affected by the threat.

PHP - a language that dates back to the early 1990s and initially stood for "Personal Page" - underpins huge parts of the public-facing web and is baked into WordPress, Drupal, Joomla and Magento sites, meaning that any critical vulnerability potentially has enormous knock-on consequences.

"All servers using any version of PHP released in the last 20 years will be vulnerable," said Tiffany Farriss, the interim chief executive of the Drupal Association. "This issue impacts the majority of the Internet."

Cybersecurity agencies around the world have urged PHP users to update immediately or take websites offline until patches can be applied.

According to data from Censys, the internet intelligence firm, 1.5 million out of 2.6 million hosts report running a version of PHP for which there is no fix.

The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities. The operator of the online encyclopaedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched, while the Internet Archive, the sprawling online library, said it also briefly went offline to deal with the issue.

Even some world leaders, who don't typically get involved with software updates, weighed in. The Dutch prime minister said he was closely monitoring the situation. Japanese Prime Minister Sanae Takaichi in a post on X said website owners should "check whether your live site uses PHP and prepare to apply the new fix."

New Zealand's National Cyber Security Centre urged organisations to immediately apply security patches for critical vulnerabilities in the PHP programming language.

The centre said the vulnerabilities could allow attackers to take full control of a website, web server or web service, potentially defacing or taking websites offline.

A patch was released by the PHP Foundation at 3am on Thursday, New Zealand daylight time.

It said the patch will protect systems using PHP, but further updates from software and web service providers may also be needed.

It warned that systems running older, unsupported versions of PHP will remain vulnerable unless organisations apply custom patches or receive fixes through enterprise operating system providers.

Organisations unable to patch immediately should consider disabling public-facing web services, the centre said.

- Reuters, with additional reporting by RNZ