Kathmandu, October 22 s
Government websites in various countries, including Nepal, have gone offline after researchers found two serious cybersecurity vulnerabilities in PHP, the programming language.
Cybersecurity agencies had urged the organisations concerned to apply PHP’s security updates immediately and, if they could not, to temporarily keep their websites shut down.
A security update fixing the vulnerabilities was released on Wednesday afternoon. However, organisations that could not update in time were advised to take their websites offline temporarily.
As of this Thursday morning, Nepal’s .gov.np websites are not opening. The websites of the Office of the President, the Office of the Prime Minister, various ministries and municipalities are not accessible.
Citing the security risk, the Finnish government has also temporarily shut down its public web services. In the UK, the City of Edinburgh Council and the BBC have taken some of their web pages offline. The Netherlands’ cybersecurity agency has also said it is temporarily taking its website down because of the risk.
The US National Security Agency (NSA) has likewise advised, via the social media platform X, that organisations unable to apply the security update keep their systems offline.
According to the NSA, the vulnerabilities could give attackers direct access to a server’s file system or database. This carries the risk of sensitive information being stolen or unauthorised access to the system being established.
AI found the serious vulnerabilities
The two security flaws were discovered with the help of artificial intelligence (AI). The cybersecurity company Wiz has described them as among the most serious vulnerabilities yet found using AI.
With the rapid advance of AI, the field of cybersecurity is also undergoing major change. AI is helping identify vulnerabilities hidden in software. But it is equally important to take timely security measures to prevent such vulnerabilities from being exploited.
Meanwhile, the White House has said that US federal agencies are working with leading AI labs to resolve the security problem. The collaboration aims to reduce risk and speed up the rollout of security updates.
Cybersecurity agencies have urged the organisations concerned to apply PHP’s security update immediately and, if they cannot, to temporarily take vulnerable systems offline.
