IT threats to society

Millions of websites potentially at risk from a serious security vulnerability

Security researchers have issued two warnings related to the programming language PHP, which serves as a foundational element of the internet. According to Reuters and Bloomberg, these security vulnerabilities allow an attacker to compromise websites.

"This flaw is so critical that someone could execute commands on a server without needing a username, password, or any other credentials," IT security expert David Jacoby tells Aftonbladet.

An update was released at 16:00, and the National Cybersecurity Center in Sweden is urging all organizations to update their systems immediately—or, failing that, to disconnect them from the internet.

Several countries, including Finland and the Netherlands, have taken action this afternoon by shutting down a number of government websites.

The flaw is classified as critical—9.2 on a 10-point scale

The security vulnerability discovered in the vital programming language PHP has been assigned a score of 9.2 out of 10 on the CVSS scale—a system that functions much like an earthquake scale for digital threats. A score of 9.2 classifies the vulnerability as critical.

"It is essential that we put a stop to this, so that cybercriminals do not gain further leverage," IT security expert David Jacoby tells Aftonbladet. The issue is linked to the programming language PHP, and a security update to address the problem was released at 4:00 PM Swedish time. Throughout the afternoon, government agencies in several countries have taken action by shutting down their websites.

Used on 69 percent of all websites – NSA issues alert

The US National Security Agency (NSA)—joining cybersecurity authorities in other countries—is urging all organizations that use the programming language PHP to update their systems immediately.

"These security flaws often grant attackers direct access to the server's file system or database," the NSA writes.

This follows the discovery of two critical vulnerabilities in the programming language. PHP released an update at 4:00 PM today. According to NBC News, PHP is used on 69 percent of the world's websites.

Several government agencies—including those in Finland, Denmark, and the Netherlands—have taken their websites offline while waiting for the updates to take effect. Major international sites, such as 4chan, are also currently down.