A number of government and business websites went offline on Wednesday as a security measure after a critical software update was issued over vulnerabilities in PHP, a programming language used extensively across the internet.
The developers of PHP said that a set of new updates fixing two previously identified critical vulnerabilities was now live, and strongly encouraged users to update software immediately.
It led to tech teams around the world scrambling to patch the critical flaw, while cyber security officials said that those unable to apply the fixes should consider temporarily taking their websites down.
Alp Toker, a cyber security expert and director at NetBlocks, called the issue "highly impactful" - and warned the disruption caused by nefarious actors, which has so far been "limited", could become "more widespread".
Speaking to Matt Barbet on The World, Mr Toker explained that the incident "means that anybody on the web can essentially access your web server if you're running the [PHP] software".
He said that the risk had been "very limited because the people who found the vulnerability kept it under wraps for quite a while, but in the last few days it has been seen in the wild".
Mr Toker added that AI agents could "reproduce the attack much more easily", warning that it is "just the beginning of a wider wave of attacks".
"These systems are going to continue to get compromised - month after month, year after year," he said.
'Critical security issues'
Websites linked to governments across Europe went offline on Wednesday as organisations rushed to protect their systems, although some are now back up and running.
In the UK, the Office for Budget Responsibility (OBR) said it had taken its website offline "in view of the critical security issues affecting PHP".
Oxfordshire County Council and Hillingdon Council both separately said they had temporarily taken down their websites as a precaution while they investigate.
A UK government spokesperson said work was under way to "identify and patch any potential exposure".
They added: "We encourage all organisations - private and public, large and small - to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems."
Meanwhile, the US National Security Agency and the Australian Cyber Security Centre both urged organisations to remain vigilant and apply updates where possible.
The Wikimedia Foundation, which runs online encyclopaedia Wikipedia, was one company on Wednesday that said it was in the process of addressing security vulnerabilities in the PHP programming language.
More from Sky News:
Why is Poland reopening Cold War bunkers?
Law must be updated to protect 'backbone' of UK
PHP widely used
PHP is used by almost 70% of websites, according to cyber security firm Cloudflare, and underpins popular platforms such as WordPress and Magento.
It said the two vulnerabilities found, which AI agents helped to uncover, were rated 9.2 out of 10 on the CVSS v4.0 severity scale.
OpenAI, which runs ChatGPT, said it has been leading a team of researchers to address the flaw in PHP over the past two months - and supported its developers as it led the fixes.
The company called the incident "one of the most impactful security issues in recent memory", adding that while AI can help to uncover issues, it can also aid attackers.
On Tuesday, the European Union Computer Emergency Response Team (CERT-EU) said the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that could allow attackers to run malicious code on vulnerable systems without logging in.
It urged organisations to prepare for the immediate patching of affected assets.
Telecoms minister Ian Murray told the Sky News Defence Insider app that he would move "as quickly as possible" to update the law and ensure far greater punishments can be imposed on hostile actors who target such infrastructure, which carries the bulk of the nation's data and gas supplies.
Proposed sanctions include extending a maximum prison term from 5 to 14 years, and the ability to impose unlimited fines.
Russia has been accused of conducting a covert operation over cables and pipelines in waters north of the UK, using three submarines.
Any updated legislation would not be used against hostile states.
However, the Kremlin is believed to hire criminals and other proxies to conduct acts of sabotage on its behalf. The law would apply to such individuals.
Mr Murray said he hoped that the prospect of such a length prison term would act as a deterrence.
"Undersea cables are the hidden backbone of modern Britain, carrying the data we rely on every day to message friends and family, do our banking, and run our businesses," the minister said separately in a statement.
"The threats we face have changed dramatically, with suspicious Russian activity around critical undersea infrastructure, yet some of the laws protecting these vital connections date back more than a century.
"We intend to modernise those laws with tougher penalties, stronger requirements on industry and new powers to protect our national security, making sure the UK's critical infrastructure is fit for the threats of today and tomorrow."
More from Sky News:
Will approved North sea drilling plans bring down energy bills?
Vital clues could help predict prostate cancer years in advance
Fibre-optic cables running along the seabed carry around 99% of the UK's international data, underpinning everything from messages and video calls to online banking and shopping.
Any significant disruption in this flow of data would risk derailing daily life and could have a devastating impact on the economy.
The same is true for any attack against the UK's undersea pipelines that provide 74% of the nation's gas supply as well as its grid of undersea electricity cables.
In its push to update legislation governing underwater infrastructure, which dates back to 1885, the government is publishing a white paper on Thursday that sets out its proposals, which also includes requiring the companies that provide the subsea cables and pipelines to do more to identify sabotage and espionage risks.
The government is seeking views on the document from industry and other experts over the next 12 weeks.
Mr Murray said the legislation would be updated in the current parliament.
It follows cases in which several notorious murderers avoided facing up to the judge.
The law has already been changed to allow an extra two years for those who refuse, but the Ministry of Justice (MoJ) admitted it's "little deterrent" to people on a very long sentence.
Ministers hope the new penalties will be a tougher deterrent and give offenders "something more to lose".
The MoJ said the plans will allow crown court judges to impose the following penalties:
- Loss of prison privileges for almost three months (84 days)
- Cellular confinement for up to three weeks (21 days)
- Loss of social visits for nearly a month (27 days)
- Restrictions on social visits to once every four weeks, for almost three months (84 days)
Killers who disrupt their sentencing hearing will be subject to the same consequences.
Visits from prisoners' children will be exempt in cases where it's in the child's best interests.
Eighteen to 20-year-olds in young offender institutions will also only face up to 10 days' confinement, while the removal of other privileges will be capped at 21 days.
The MoJ said no penalty can guarantee prisoners attend sentencing but the new rules will "strengthen the consequences".
"Criminals should not be able to pick and choose when they face justice," said prisons minister Catherine McKinnell.
"Refusing to turn up to sentencing is an insult to victims and their families, and offenders must face the consequences."
The victims' commissioner for England and Wales, Claire Waxman, also welcomed the move.
She said the announcement was testament to "the tireless efforts of victims' families who refused to accept that offenders could simply opt out of facing justice".
More from Sky News:
Ex DUP leader accused of raping woman inside parliament
Websites across Europe taken down to protect systems
Ms Waxman added: "Having worked with the families of Sabina Nessa, Zara Aleena and Jan Mustafa, I know how offenders' refusal to attend sentencing hearings compounds trauma and robs families of one of the very few moments of accountability in the justice process.
"Their determined campaigning, alongside that of Olivia Pratt-Korbel's family, helped ensure that this harm could no longer be ignored."
Other killers who have refused to attend sentencing include triple crossbow killer Kyle Clifford, while Southport knifeman Axel Rudakubana was removed from court after shouting and claiming he felt ill.
The plans will be introduced to parliament on Thursday and should come into effect next year.
The Pope had the lower lobe of his right lung removed in surgery on 13 October and was diagnosed with lung adenocarcinoma, the most common form of lung cancer.
He returned to the Vatican on Saturday, four days after the procedure, and is gradually resuming his normal duties.
The Pope's personal physician, Dr Luigi Carbone, and his surgeon, Dr Stefano Margaritora, said in a statement that the results of the tests on tissue removed during his surgery confirmed the initial diagnosis, and the cancer had not spread.
"A subsequent oncology assessment confirmed that no further treatment is necessary," the doctors said.
Pope Leo returned to St Peter's Square on Wednesday, waving to pilgrims and blessing babies from his open-air popemobile.
His weekly audience, the first held by the 71-year-old pontiff since 7 October, followed the normal format.
Crowds started gathering hours beforehand, holding umbrellas under drizzling grey skies.
"The first thing I want to say to you is thank you for the support and prayers," Pope Leo said in his opening remarks, without specifically mentioning his health.
"Thanks be to God for his generosity," he added, as cheers broke out.
More from Sky News:
Nigeria confirms Ebola case as outbreak continues to spread
Man arrested in Pakistan over $126m counterfeit postage scheme
The Pope was originally sent for treatment at Rome's Gemelli hospital for the removal of the small nodule, which he said was spotted early during a recent check-up.
Pre-operative tests had suggested adenocarcinoma, and this was confirmed during the operation, the Vatican said.
The surgery on 13 October lasted around 90 minutes and was described as successful.
The Pope was expected to recover in hospital for about a week, but left earlier than expected.
The pontiff left on Saturday afternoon after doctors said he was "fit for discharge" following blood tests and a chest X-ray.
He then led a traditional noontime Angelus prayer from a window of the papal apartment in the Apostolic Palace overlooking St Peter's Square in Vatican City.
After greeting the crowds gathered on Sunday, he thanked those around the world who have prayed for his health and recovery in recent days.
He said: "I have truly felt your support. Thank you."
It was still unclear whether the US-born pontiff would go ahead with a planned trip to Uruguay, Argentina and Peru, scheduled for 6 to 17 November.
The Pope's lead surgeon said last week there were "no clinical reasons" preventing him from travelling to South America, but the Vatican's secretary of state has indicated the pontiff may need to adjust the pace of his schedule.
The Metropolitan Police did not identify the 63-year-old politician but said in a statement it is investigating a report passed on by officers in Northern Ireland.
It said: "On Tuesday October 13, the Met received a report, referred to us by Police Service of Northern Ireland, relating to an allegation of rape in 2016, by a man now aged 63.
"The allegation relates to one victim who is being supported by specialist officers.
"The investigation is in its early stages. No arrests have been made and inquiries remain ongoing."
Earlier this month, Donaldson was given a 15-year sentence for a series of historical sex offences against two women when they were children.
He was convicted of one count of rape, 13 indecent assaults, and four counts of gross indecency, committed between 1985 and 2008.
Donaldson's solicitor has previously confirmed that papers have been lodged for an appeal.