There is currently a great deal of attention on serious vulnerabilities in PHP. But what exactly is PHP? Why can a vulnerability in this programming language have such serious consequences? And why do organisations sometimes choose to temporarily take their websites or systems offline?
What is PHP?
PHP is a programming language widely used to build websites and web applications. Examples include websites that retrieve information from a database, process login credentials or handle orders. PHP runs on the server behind the website and enables these types of functionality to work.
PHP is not inherently an insecure technology. The issue lies in the vulnerabilities that may be present in the software.
What is happening?
Cybersecurity experts are warning about vulnerabilities collectively known as PHP2Shell. According to their findings, these could allow malicious actors to execute their own code on vulnerable systems that use PHP.
The potential consequences are serious. These include stealing passwords, accessing data or carrying out fraudulent purchases. Depending on the level of access an attacker gains, even control of a server could be at risk.
This does not mean that every website using PHP has automatically been hacked. However, vulnerabilities of this kind require prompt assessment and appropriate action.
Why are organisations taking their websites offline?
When a vulnerability poses a serious risk, temporarily disabling systems can be a sensible precaution. This is particularly true when the extent of the risk is not yet clear or when systems cannot yet be updated securely.
A recent example is Albert Heijn. Following a cybersecurity incident on 11 October, various systems were shut down as a precaution. As a result, the website, app and online delivery services were temporarily affected. Logistics operations were also impacted.
It is important to note that there is no confirmation that the incident at Albert Heijn is related to the PHP vulnerabilities. However, the example illustrates how significantly a cybersecurity incident can affect customers and business operations.
Taking a website offline does not resolve the underlying vulnerability. However, it can help limit the risks until systems can be restored securely.
A vulnerability that may have existed for years
What makes these PHP vulnerabilities particularly noteworthy is the reporting that the code in question has been present in PHP since 2004.
Firstly, this is reassuring: the existence of a vulnerability does not automatically mean that systems are being attacked on a large scale.
And secondly, it raises questions. If the vulnerability has been present for so long, malicious actors could potentially have exploited it earlier. Whether this has actually happened has not been established.
It highlights the need to continually scrutinise technology that has been in use for years, particularly as new security risks come to light.
What can organisations learn from this?
This incident demonstrates how important it is to know which technologies you use, where they run, and who is responsible for maintaining and securing them.
Before you can determine whether a vulnerability affects your organisation, you first need to know whether you use the technology in question at all.
Cybersecurity is not just about fixing vulnerabilities. It also starts with understanding your own systems, dependencies and risks.