What to know
- Several Canadian websites, including Government of Canada websites, experienced disruptions as developers worked to patch two PHP vulnerabilities.
- The flaws could allow malicious actors to execute code on vulnerable servers and potentially access sensitive information.
- The federal government said there was no indication its systems or information holdings had been compromised.
- Toronto-based cybersecurity analyst Ritesh Kotak says taking vulnerable websites offline can help reduce the risk of an attack while security fixes are implemented.
- Kotak expects many affected websites to return soon, although developers must test updates to ensure they work properly and do not introduce new issues.
Several websites, including Government of Canada websites, have been temporarily taken down, as they work to implement security fixes after vulnerabilities in a widely-utilized programming language were found, leaving them vulnerable to cyber attacks.
On Wednesday, The PHP Foundation announced it had released new fixes to patch over two vulnerabilities that were found on its software. According to developers, these vulnerabilities could allow hackers to execute code on PHP servers and access their information.
The announcement also urged developers to update their servers with the latest fixes urgently, while authorities like the FBI urged organizations to implement the fixes or bring their systems offline until they could do so.
PHP is an open-source server scripting language designed for web development that powers several public-facing websites across the globe, including Government of Canada websites.
As a result of the announcement, several websites were taken down on Monday while developers implemented fixes. While some of them have been restored, several continue to face disruptions.
In a statement issued on Thursday, the Government of Canada said it’s applying security updates in response to the PHP vulnerabilities, and that some of its websites may be temporarily unavailable or experience disruptions in the meantime.
“The Government of Canada works diligently to defend its systems from cyber threats by enhancing cyber security management practices and identifying threats and vulnerabilities,” the statement reads.
“There is no indication at this time that any Government of Canada systems or information holdings have been compromised.”
What is PHP and why do so many websites use it?
According to Toronto-based cybersecurity tech analyst Ritesh Kotak, PHP is the foundation for the majority of websites and applications that public access online. It is essentially the technology behind most website features.
“Think of it this way: when you go to an e-commerce site and you’re putting items in your shopping cart or you’re logging into a particular portal, the technology or the code, the scripts, behind it is PHP,” he said.
This specific programming language is highly used across the globe because it has become foundational to the way systems operate.
“PHP is an open source foundation. It’s been around for several years. In fact, if you’re learning coding or any type of programming, it’s literally the fundamental course, along with HTML, that everyone has to take,” he said.
“That’s how ingrained it is in all the systems that we’ve come to use and love, and why we’ve seen such huge adoption of this technology.”
What could be the impact of PHP vulnerabilities?
Because it is so widely used, vulnerabilities on PHP systems can be quite serious, as they have the potential to impact billions of websites.
As explained by Kotak, vulnerabilities could make it possible for hackers to break into these systems and access any information present in them. In this case, the systems have not been hacked, but the vulnerabilities could make it easier for that to happen.
“Think of it as if you still have a door into your house, and you still have a lock, but essentially the hackers are able to get a key. So, until that issue is patched, until that lock is changed, hackers would be able to infiltrate the network,” he said.
If hackers obtained access to that data, they could then access crucial information, like login credentials, users’ data, and even codes that power websites, redirect it to other spaces, and even manipulate entire websites.
“It doesn’t matter what operating system you’re using, it doesn’t matter what software you might have deployed. There’s a good chance that at some point there’s some PHP script running in the background… Just imagine the billions and billions of page websites and apps that are out there using this particular script and type of technology,” Kotak explained.
Shutting the websites down while the vulnerabilities are fixed is an effective way to prevent these kinds of issues from taking place, according to the expert.
Most systems should be back running soon
Since PHP vulnerabilities were first reported on Wednesday, various websites that were taken down have now been updated and restored.
Kotak explains that patching over the vulnerabilities is not as simple as hitting an update button, as developers now have to perform a more complex analysis and testing of their systems to make sure they can sustain the upgrades and that they will be effective, instead of creating new issues. This process is called patch management.
However, given the seriousness of the issue, Kotak expects most websites to be back and running soon.
“A patch is already out there. In fact, the PHP Foundation had to move up their timelines just given the severity of this vulnerability… So, we don’t know how long it’s going to take, but it should be relatively quick.”
According to Kotak, cybersecurity vulnerabilities in general have become more common over the last few years, as developers have to adapt to emerging technologies powered by artificial intelligence that threaten existing security systems.
“When it comes to cybersecurity, it’s just gone really easy for artificial intelligence to be weaponized against individuals and organizations where it can go and scan the internet, look for unpatched sites or systems, write scripts that are available to go and exfiltrate and infiltrate networks,” he said.
“This is a very scary time when it comes to our digital sovereignty and AI is being used as a sword and being weaponized to attack society, and it’s also at the same time being used as a shield to assist organizations in identifying potential vulnerabilities and writing patches.”
As developers work to patch over any open cracks, Kotak said users should navigate websites and applications with caution and the assumption that any information they input on these systems could be breached at any point.
“No matter how much money, how many tools we throw at protecting our infrastructure, it seems that hackers are always finding a way, and AI isn’t making it [easier]. And I think from that particular perspective, it’s making it that much more that much more difficult.”
