PHP cybersecurity risk: What is it and who is at risk?

A recent vulnerability in PHP code has set off a global scramble to fortify security measures online. Photo by iStock /Getty Images

Article content

In the past 48 hours, you may have noticed a number of websites were down for unscheduled maintenance or temporarily unavailable.

Article content

That’s due to the discovery of a cybersecurity weakness found in PHP code, which is used across the internet, including the Government of B.C.’s official channels, your local library portal and educational institutions.

Article content

Article content

Article content

Article content

What is PHP and why’s it in the news right now?

Article content

Article content

PHP stands for Hypertext Preprocessor, which is an open-source scripting language used on the server-side of many websites.

Article content

Recently, news emerged that white hat researchers, also known as ethical hackers, had discovered a weak point in the PHP language back in 2024.

Article content

According to Karthik Pattabiraman, a University of B.C. professor specializing in cybersecurity, the vulnerability was ignored at the time as it was considered too difficult to exploit.

Article content

“Nobody paid attention to it,” said Pattabiraman. “But recently, with the advent of AI models … and human help, they discovered that this vulnerability could actually be exploited.”

Article content

Has the PHP security flaw been fixed yet?

Article content

After researchers found that exploitation of the flaw was possible, they confidentially contacted the PHP Foundation, a non-profit group that maintains the language, and notified it of the discovery.

Article content

The group then quickly developed an update that would close the security gap. This week, the update was released to developers.

Article content

“They had two months to work on a patch and release it so, fortuitously, due to the preparation done, it worked out that the defenders got ahead of the game here,” said Pattabiraman.

Article content

Because a fix is now readily available, Pattabiraman said it’s a simple case of web developers updating their websites with the latest version of PHP.

Article content

“It’s relatively straightforward for administrators to apply the patch and fix and, in fact, many have already done so.”

Article content

How widespread is PHP? Which websites in B.C. have patched the security gap?

Article content

Pattabiramn says PHP is used on the back end of approximately 70 to 75 per cent of websites. Many of the major institutions you interact with daily will have websites that rely on PHP scripts to run.

Article content

On Wednesday, the Government of B.C. said that its websites and services would be temporarily offline “as a precaution.”

Article content

“Teams are working to restore services as soon as possible,” the post read.

Article content

The B.C. Institute of Technology, where winter semester registration is underway, also paused its registration on Wednesday for unscheduled maintenance.

Article content

Article content

Article content

Article content

What could happen if the vulnerability had been exploited?

Article content

Pattabiraman said there are no known cases of the vulnerability being exploited, but says if it had been discovered by bad agents, it could have led to the loss of important data or websites being defaced or taken down. Other risks include the theft of credentials or phishing attacks.

Article content

“We were ahead of the game. Maybe the next time this happens, it may not be the case,” he cautioned. “So it’s super important to make sure we invest, as a society, in finding and fixing vulnerabilities proactively so that the software we depend on is actually secure.”

Article content

Is there anything I can do to protect myself in this case and beyond?

Article content

The PHP vulnerability is an issue with the scripting language itself, not an application or a website specifically, and not something everyday internet users need to worry about.

Article content

“It’s not something that is due to weak passwords or any of the usual things that end users can take precautions against,” said Pattabiraman. “Rather, this is more about website administrators upgrading or patching their PHP versions, upgrading their website software.