Kathmandu, October 22: Government websites in Nepal and several other countries have been affected after a serious security vulnerability was discovered in PHP, a widely used programming language. Some government websites in Nepal have reportedly become inaccessible.
Following the public disclosure of the vulnerability, the risk of hackers exploiting it has increased. Website operators are therefore working to secure their systems. According to reports, no official update has been issued in Nepal because of the government holiday.
According to Reuters, PHP developers issued an emergency update on Wednesday to address the security vulnerability and urged users to update their systems immediately. The vulnerability was reportedly discovered with the assistance of artificial intelligence (AI), which helped identify flaws that had remained hidden in software for years.
Technology companies have warned that some hackers have already begun exploiting these vulnerabilities. Cybersecurity experts say attacks against vulnerable servers could increase because a patch has already been released and AI tools have made it easier to analyse the technical details of the vulnerability.
Costin Raiu, co-founder of cybersecurity research organisation TLP:BLACK, described the situation as a race among hackers to exploit the vulnerability. According to him, there is a risk that vulnerable servers across the internet could be compromised and brought under collective control.
Developed in the early 1990s, PHP is used by popular website platforms such as WordPress, Drupal, Joomla and Magento. Experts have warned that a security vulnerability in PHP could therefore affect a significant portion of the internet.
According to Tiffany Farris, interim chief executive of the Drupal Association, servers running PHP versions released over the past 20 years could be at risk.
Data from internet intelligence company Censys show that approximately 1.5 million of the 2.6 million hosts running PHP are still using versions for which security fixes have not been applied.
Cybersecurity agencies worldwide have urged users to install the latest updates immediately. Website operators who cannot update their systems promptly have been advised to take their websites temporarily offline to protect them against potential cyberattacks.
Login to add a comment