LONDON, Oct. 22 (Xinhua) -- A total of 32 British government services were offline and four were partially unavailable following a security threat involving the widely used PHP programming language, Sky News reported Thursday, citing a government minister.
Liz Lloyd, the government's minister for space, cyber and regulatory reform, told the House of Lords that the disruption mainly resulted from precautionary measures to protect systems while security updates were being installed, according to Sky News.
She said the government had acted before public disclosure and that Britain's National Cyber Security Center (NCSC) had coordinated with cybersecurity companies in advance, helping them prepare patches and other mitigations for their customers, said the report.
Sky News separately quoted a Downing Street spokesperson as saying no large public-facing services had been affected and some smaller services had been taken down for updates rather than because they had been hacked.
The NCSC, in an alert published Wednesday, urged British organizations to take immediate action over two vulnerabilities in PHP, a programming language used by web servers to generate website content and support web applications.
The agency said attackers could trigger an out-of-memory condition that causes memory corruption. Under certain conditions, this could let them run code remotely without authentication. Security updates addressing the flaws have been released, it said.
The disruption extended beyond Britain. According to an earlier Sky News update, France's interior ministry placed all its websites into preventive maintenance, while Finland's state IT services provider Valtori took government public network services offline as a precaution.
In Britain, the Office for Budget Responsibility temporarily took its website offline over the PHP security issues, Sky News reported. Oxfordshire County Council and Hillingdon Council also took their websites offline as a precaution. The homepages of all three websites were accessible by early Thursday afternoon.
Meanwhile, the broadcaster also cited Amazon Web Services as saying the vulnerability was being widely exploited and that suspected hackers had tried to exploit it days before it was publicly announced.
The NCSC urged organizations to identify systems using PHP, prioritize those exposed to the internet and install the latest fixed version. Those unable to update should apply temporary mitigations. If these cannot be implemented, or would take too long, organizations should consider taking affected systems offline until the risk can be fully mitigated.
Organizations unable to update or disable systems immediately should check for evidence of compromise and attacker-installed backdoors before upgrading or applying mitigations, the agency said. ■
