Japan’s prime minister. A hospital in Germany. Taxpayers in France. An I.T. firm in Kenya.
People’s online routines were disrupted around the globe on Wednesday and Thursday as governments and companies rushed to protect their websites, after security researchers found major flaws in a widely used programming language called PHP.
Many took their websites down as an emergency precaution while they fixed the flaw, which was identified using artificial intelligence. A fix was quickly available, and software developers and tech departments from Helsinki to New York scrambled to apply it, meaning that in many cases the outages lasted less than a day.
But the flaw and the temporary shutdowns it provoked showed how far-reaching potential cyberattacks could be — and how deeply the internet has embedded itself into our lives.
In Finland, one of the most digitized countries in the world, the government’s public websites were temporarily shut down, forcing even basic tasks to pause.
“It’s in the fabric of our society, a lot of these services,” said Kalle Pusa, 33, a software developer who is involved in Helsinki city politics. “And I think yesterday and today, a lot of the fabric was a bit ripped apart.”
Mr. Pusa was trying to arrange for the local garbage department to pick up an old couch. But that had to wait until the site was back online.
“It had very strange consequences,” he said.
The British government said that 32 of its services went down as a precautionary measure. In Germany, the websites of states and major cities like Berlin and Munich were affected. The Hannover Medical School assured users that its hospital had not been hacked.
In Japan, Prime Minister Sanae Takaichi encouraged businesses to take down their sites, saying on social media that access to her official website had been briefly suspended until updates were installed.
In the Netherlands, several official websites were offline on Wednesday and into Thursday, including the country’s digital ID site, a portal that gives citizens access to government services, and a crime tip website.
While recent data suggests that the use of PHP is waning, about 70 percent of all websites and web applications use it, by some estimates.
Matthew Prince, the chief executive of Cloudflare, a company that helps websites secure and manage their internet traffic, said that it saw “thousands of attempts to exploit” the flaw in the hours before it was publicly announced.
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,” Mr. Prince said in a social media post.
Security researchers using OpenAI’s advanced A.I. models found the vulnerability, which could allow hackers to take control of servers, steal private data and deface websites, experts said.
PHP, a decades-old language, is a critical ingredient in popular services like WordPress and Drupal. The nonprofit PHP Foundation released a patch Wednesday morning, and security experts said that correctly applying it should protect websites from harm.
But fast-moving hackers could exploit the flaws if they are not fixed quickly enough.
“Any machine running this software — and there’s a lot of machines running this software — is vulnerable,” said Seth Kaufman, a software developer based in the New York area.
Mr. Kaufman, who develops open-source software for museums and cultural organizations, said he used PHP because it is a simple, free coding language. It’s been around forever, he said, and some people in the coding community think it’s clunky. But mostly, he said, it works.
“It does what it’s supposed to do,” he said. “It’s effective. So that’s why it’s still used everywhere.”
That much was evident in the diversity of websites that were taken down as businesses and authorities rushed to fix the flaw.
Anthony Wambua, who runs an I.T. firm in Nairobi, woke up early to do so. He worried that PHP was now “synonymous with serious vulnerabilities.”
In Kenya, which prides itself on its embrace of online services, Mr. Wambua and others worried that the government’s response was sluggish. “I am scared that given the slow speed at which our government moves some of their sites might still be hit,” he said.
In Britain, fans of the reality television show “The Traitors” were briefly met with a cutesy error message with a picture of knitted mice. In France, services on the official tax website had not yet been fully restored as of Thursday evening.
While the temporary outage turned out to be a “road hump” for institutions with large I.T. departments, small businesses went dark for up to seven hours, said Alistair Gleaves, who provides communication services for small businesses.
Mr. Gleaves, who is based in Exeter, in southwest England, quickly warned his clients when news of the flaw broke late Wednesday. His own business suffered when third-party payment services went offline.
He saw a glimmer of hope: A.I. models had helped uncover the flaw. There has been a lot of concern that A.I. is “going to take over the world, it’s going to kill us all,” he said.
But here, he added, “it found the problem.”
The post From Kenya to Japan, Rush to Fix Security Flaw Takes Sites Briefly Offline appeared first on New York Times.
