MONTREAL - Several websites around the world, including Government of Canada sites, went dark as operators raced to patch cracks in a programming language called PHP. Cybersecurity experts call it one of the largest online vulnerability issues they have ever had to fix to protect against malicious actors.
“This is quite significant since 70 per cent of public-facing apps and websites use PHP,” said tech and cybersecurity expert Ritesh Kotak.
Millions of servers could be at risk, and agencies including the FBI’s cyber division warned that the vulnerabilities increased the risk of a wide range of networks being compromised.
Montreal’s transit authority, the STM, shut down its stm.info website just before noon on Wednesday.
It confirmed to CTV News that this was a precautionary measure in the face of a security risk that affected internet sites globally.
After 2 p.m., website visitors were automatically redirected to a new version of the site, beta.stm.info, which allowed users to access information regarding the state of service on the transit system.
Quebec’s liquor commission, the SAQ, also shut down its site as a preventative measure, though it said no breach was detected in its system.
Evan Solomon, Canada’s minister of artificial intelligence and digital innovation, said in an online post that some Government of Canada websites had been temporarily taken offline as a precaution to “protect government systems and Canadians’ information, following guidance from the Canadian Centre for Cyber Security.”
“We take this situation extremely seriously,” Solomon added online. “Thank you to the cyber security teams working to protect the services Canadians rely on. Affected websites will be restored once patches are applied.”
The European Union (EU) Agency for Cybersecurity also identified vulnerabilities and advised organizations to shut down their sites until patches could fix the issue. Finland’s National Land Survey and Helsinki Book Fair sites went dark.
PHP is a programming language that Kotak said is the foundation for a wide range of websites and apps.
“Think of it as the foundation of a building and the vulnerabilities that have been discovered could potentially impact about 70 per cent of things that most of us do online,” he said. “For instance, when we sign in to a website or put things in an online shopping cart, these things require PHP coding.”
Artificial intelligence agents helped uncover two critical vulnerabilities in August. OpenAI said in a blog post that it led a coalition including researchers and security providers to address the vulnerabilities. Programmers at PHP have urged clients worldwide to quickly apply the fix, because just as AI helped uncover the flaws, it can aid attackers.
Hackers could exploit the flaws to steal data, deface pages, or compromise entire systems, and worldwide warnings pushed operators of several websites to go offline as a precaution until they could fully secure their sites.
Experts said individual users should practice good cybersecurity hygiene, which includes checking accounts for any suspicious activity and reporting any issues to organizations like financial institutions.
