Artificial intelligence found 10-year-old vulnerabilities: Government websites in Europe temporarily shut down
In Germany and other European countries, the websites of government agencies, hospitals, and other organizations have been temporarily taken offline due to two critical security vulnerabilities identified in the PHP programming language. According to DW, the vulnerabilities, which went unnoticed for more than a decade, were discovered using artificial intelligence.
Artificial intelligence identified 10-year-old vulnerabilities: Government websites temporarily shut down in Europe
The measures implemented on October 21 were aimed at protecting the websites from potential attacks and updating the systems. In particular, the US National Security Agency and Germany's Federal Office for Information Security — BSI strongly recommended such a measure.
In Germany, the federal IT service provider ITZBund temporarily shut down a number of government websites. Some city administrations and police departments also suspended their online services to update systems. The website of the Charité clinic in Berlin was also temporarily non-operational.
Germany's Ministry for Digital Transformation stated that these steps were a precautionary measure. According to the ministry, no security incidents related to these vulnerabilities have been reported.
Similar measures were taken in other European countries as well. The French Ministry of the Interior temporarily shut down prefecture websites, and the Belgian Ministry of Foreign Affairs closed its online resources until the vulnerabilities were resolved.
In the Netherlands, the activities of the websites of the Port of Rotterdam, the Overheid government portal, the KNVB football association, five major political parties, and a number of hospitals were suspended.
Security warnings also spread outside Europe. Japanese Prime Minister Sanae Takaichi urged website owners to check whether they are using PHP and install the necessary updates. If it is not possible to do this quickly, she recommended temporarily shutting down the resources.
The vulnerabilities were discovered by experts from Calif and Wiz using Google's Gemini and OpenAI's ChatGPT artificial intelligence models.
According to Wiz, these vulnerabilities went unnoticed for over a decade. Exploiting them was extremely complex for a human, but artificial intelligence is making it easier to perform such tasks and replicate them on a large scale.
PHP is used in the server side of many websites and online services worldwide. According to the report, the problem may affect various versions starting from PHP 5, released in 2004.
Fixes have been prepared for supported versions. Users of older versions were advised to update their software.