Ottawa taking down some federal websites over critical global vulnerability

The Canadian government is temporarily taking down some of its own websites to fix a serious coding language vulnerability that sent the cyber security world into a panic Wednesday.

PHP, the coding language that underpins a majority of the world’s websites, was found to have two critical vulnerabilities by researchers probing the internet’s defences using AI tools.

The vulnerability could allow attackers to steal information, deface or even take over websites and servers.

In a social media post Wednesday, AI Minister Evan Solomon said the government was taking down some websites on the advice of the Communications Security Establishment’s (CSE) cyber security team.

“This is a global issue, and other governments and organizations are also taking protective measures. If your organization uses PHP, apply the latest security updates as soon as possible and follow (the Canadian Centre for Cyber Security) for updates,” Solomon’s post read.

“We take this situation extremely seriously … Affected websites will be restored once patches are applied.”

Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems.

Developers ​of the PHP programming language said Tuesday they had identified two critical vulnerabilities, and urged ​users to update their sites as soon as a fix was released. ⁠With reports that hackers were already exploiting the flaws to break into websites, government agencies in ​the Netherlands and Finland were among those that took sites offline as a precaution.

PHP underpins large ​parts of the internet, raising concerns that a significant number of websites could be vulnerable to attack.

“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful ​lot of software that doesn’t even advertise that it runs PHP under the hood,” cybersecurity company ​Huntress said in a blog post.

Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare (NET.N), said ⁠that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure.

“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update,” he said on X.

Wordfence, a security ​plugin that protects WordPress ​websites, said all WordPress ⁠sites run on a PHP-installed server. It warned that automatic updates would not apply the fix and advised site owners to find out who ​is responsible for updating PHP on their sites.

Cybersecurity agencies in Europe, ​Australia, Japan and ⁠Britain have urged PHP users to update immediately or take websites offline until patches can be applied. The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because ⁠of ​the vulnerabilities.

Officials have said that all PHP versions from PHP ​5 onward could be affected, although PHP has not yet disclosed which versions are vulnerable.

With files from Reuters.