Numerous websites, including those of the Canadian government, experienced downtime on Wednesday to address vulnerabilities discovered in PHP, a commonly used programming language. PHP developers promptly issued critical updates to address the security flaws and advised website administrators to apply the fixes without delay. The PHP Foundation emphasized the urgency of updating for all PHP users to secure their systems.
Canadian Artificial Intelligence Minister Evan Solomon confirmed the temporary shutdown of some federal government websites as a precautionary step in response to the PHP vulnerabilities. Solomon stressed the importance of organizations running PHP-based websites to promptly implement the security patches, reassuring that affected websites would be restored once the fixes were in place. During the outage, both the Canadian Centre for Cyber Security and Statistics Canada websites were inaccessible.
Additional provincial sites, such as those for Newfoundland and Labrador and Prince Edward Island, were also offline, attributing the downtime to a global security incident. Elections B.C.’s website was similarly impacted on the final day of advance voting before the provincial election on Saturday. Other prominent platforms, including Wikipedia, Cloudflare, and Maple Health, also addressed the PHP vulnerabilities on the same day.
The discovery of the PHP vulnerabilities, which could be exploited for cyberattacks, was facilitated by artificial intelligence tools. PHP, a foundational language in web development, powers a significant portion of websites globally, including popular platforms like WordPress, Drupal, Joomla, and Magento. The widespread usage of PHP makes many websites susceptible to potential security breaches until the necessary updates are applied.
Experts warn that the scale of the situation is concerning, particularly for medium to small organizations that may encounter challenges in swiftly implementing the fixes due to limited resources. Cybersecurity company Wiz, utilizing artificial intelligence, identified the PHP flaw, which had existed for over a decade, and collaborated with various tech giants to develop and deploy the security patch efficiently.
While AI played a crucial role in identifying and addressing the vulnerabilities, there are concerns about malicious actors exploiting AI tools to target weaknesses in systems. The potential for cyber threats remains high, with cybersecurity agencies worldwide urging PHP users to update their systems promptly. Several governments, including those of France, the Netherlands, and other European nations, proactively took their websites offline to apply the necessary security fixes in response to the PHP vulnerabilities.