Government websites across Europe taken down over hacking fears from cyber security flaws

Cyber-security flaws have been found in programming language which powers much of the internet forcing governments and businesses to take down websites

Websites belonging to governments and businesses across Europe have been taken down over fears hackers could exploit a critical security flaw.

The problem affects PHP, a type of software used to power much of the internet, with organisations urged to update immediately or take affected sites offline.

The vulnerabilities were discovered with the help of artificial intelligence. Developers have now released updates fixing both critical issues, with users urged to install them as soon as possible.

The Finnish government’s website was one of several to be partly disabled because of the incident on Wednesday, along with the websites of several local authorities in the UK.

Oxford City Council and the City of Edinburgh Council were among the organisations to take their websites offline, while pages for some BBC programmes were unavailable.

The security issue identified by the researcher could allow attackers to remotely control any web servers running the widely used programming language, PHP.

Organisations have been advised by the National Cyber Security Centre to update to the new, fixed version of the software. If software cannot be immediately upgraded, organisations should consider taking their websites offline, the NCSC said.

The cyber division of the National Security Agency in the US warned weaknesses in the software could provide “a direct path to the server’s file system or database”.

The Wall Street Journal reported that the flaw was discovered in August by Ryan Austin, a researcher at the cybersecurity company Calif, using an advanced AI model developed by OpenAI.

PHP developers had reportedly planned a security update on Thursday, but the release was brought forward after details of its work to address the vulnerabilities leaked online.

OpenAI, which runs ChatGPT, said in the past two months it has been leading a team of researchers working to address the critical flaw in PHP, and supported its developers as it led the fixes.

The company described the incident as “one of the most impactful security issues in recent memory”, adding that while AI can help to uncover issues, it can also aid attackers.

“To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a defender’s window for maintainers and security providers to prepare fixes and protections ahead of disclosure,” it said.