The Canadian government is temporarily taking down some of its own websites to patch a serious vulnerability in the code that underpins roughly 70 per cent of the world’s websites.
The vulnerabilities, which affect the PHP coding language, sent the cyber security world into a panic Wednesday as governments and businesses braced for a wave of cyber attacks.
PHP is the programming language that runs websites, assembling their content to show to users. The vulnerabilities, which developers have already released a fix for, could allow attackers to steal information, deface or take over websites if not patched.
In a social media post Wednesday, AI Minister Evan Solomon said the government was taking down some of its websites on the advice of the Communications Security Establishment’s cyber security centre.
“This is a global issue, and other governments and organizations are also taking protective measures. If your organization uses PHP, apply the latest security updates as soon as possible and follow (the Canadian Centre for Cyber Security) for updates,” Solomon’s post read.
Get breaking National news
“We take this situation extremely seriously … Affected websites will be restored once patches are applied.”
What is the PHP coding issue?
The CSE deferred Global News’ questions, including how many government websites were affected and what measures were being taken to address the issue, to Treasury Board. The Treasury Board did not immediately respond to those questions.
The Cyber Centre issued detailed guidance Wednesday, which included immediately patching any PHP installations, identifying third-party products that use PHP and ensure they’re updated, and, when an immediate fix is not available, take down the internet-facing applications from public networks.
The vulnerabilities were publicly disclosed by two security companies: Calif, which worked with OpenAI, and Wiz, a firm owned by Google, using AI models. The two companies independently identified vulnerabilities in August, but they were only widely publicized on Wednesday.
The flaws in PHP left millions of servers across the world vulnerable to compromise all at once. Cybersecurity firms said the attacks could take the form of stolen data, defaced websites up to a full compromise of a system. By Wednesday morning, Cloudflare’s chief technology officer said evidence of early attacks was already emerging.
“It is a big deal, certainly because of the ubiquity of this technology. It’s been around since 1995, almost since the birth of the internet,” said Jason Gallaugher, the Canadian Internet Registration Authority’s (CIRA) chief technology and security officer, in an interview with Global News.
Gallaugher said that international oversight and cyber security authorities have urged websites to patch the problem immediately, but given how widespread the PHP code has been deployed, that’s proven more difficult for some.
“If for whatever reason within that website it can’t be done immediately, and there are a lot of reasons for that, than their recommendation to mitigate the risk is to pull that website offline,” Gallaugher said.
Gallaugher said most Canadian internet users may not be directly affected, and unless they also operate a website, don’t need to take additional security measures as a result of the PHP exploit.
But Canadian companies, including small businesses, need to make sure they have “access to the right people and expertise” to respond quickly to these kind of events, Gallaugher said.
“This isn’t something that companies, in particular, even small business owners can think about only when something goes wrong, or we see a very noisy incident like we have in the last 48 hours,” Gallaugher said.
With files from Reuters.
And no, your government, obsessed with foreign influencers and cautioned by our own intelligence apparatus that they were close to committing treason, and other serious and heinous crimes, know nothing about modern technology because they are all overly privileged and lacking of the appropriate skillset to perform the responsibilities granted to them by a party subsists on populism.
But, we have a government that has lost 100,000 jobs and counting so they can hold on to their dispicable policy to weaken our privacy and security further, putting everyone at risk for dumb, foreign influenced policies that are toxic to basic security.
Ben, most vulnerabilities are imposed by ignorant governments.
Right? Take alcohol delivery very in Ontario through 3rd party delivery services, as an example.
They scan your ID, because the Government compromised on a likely business demand not to require their non-employees to have alcohol sales certifications.
Now self-emplyed, unvetted people use their cell phones to scan sensitive private data in a form that is exposed to unnecessary security holes.
Now, some business has countless photographic scans of both sides of government ID and that’s deemed acceptable.
Businesses routinely ask for all of your sensitive information before they will respond to general inquiries as meaningless as a rewards program that might fetch you nominal savings for the threat they impose on you.
Yet here we are, where businesses being supported by trillions of dollars in other people’s money begging for a modicum of regulation on their own products and government won’t listen.
More improperly written software by the Code Jockeys. Maybe focus on the work when originally writing it for a change.
PHP is used everywhere. AI originally found the vulnerabilities. Security should be the mantra of anyone in IT!