Cayman firms and government react to global hack threat

Companies in Cayman are racing to protect their websites from security flaws that have been exposed in a widely used programming language.

Details of two vulnerabilities in the scripting language PHP were leaked on developer forums on 20 Oct., prompting tech companies and agencies to issue fixes and warnings.

“Any time there’s a vulnerability like this that is available for an ordinary person to download from the internet and basically press the big red hack button, giving them access to a server, it’s a big deal,” said R.J. Sudlow, the founder of Cayman-based cyber security firm Ember Lake.

“That’s why a lot of organisations are scrambling right now to figure out what they have, how they can patch it and how they can ensure that no data has been accessed.”

Sudlow said he had been having “emergency calls” with Caymanian clients since the news broke.

Around the world parts of popular websites, such as the BBC and Wikipedia, were temporarily taken offline, while security fixes were applied. There have also been reports of hackers attempting to target the PHP flaws.

PHP – a web building block

According to the Financial Times, the two PHP vulnerabilities, which have existed for decades, were uncovered with the help of AI tools from OpenAI and Google. Originally an acronym for Personal Home Page, PHP now stands for PHP: Hypertext Preprocessor and is built into most websites.

Sudlow said the vulnerabilities allow hackers to send requests to PHP elements within a website, which confuse the program into releasing information stored in its memory. That could include confidential details, such as usernames and passwords. The flaws also allow hackers to run their own malicious code on servers without logging in.

“PHP is one of the most common scripting languages for websites in the world,” said Sudlow. “It’s significant not only because of how widely it’s used, but also because it usually comes bundled with a lot of applications or websites that you might not realise are using PHP in the back end.”

Sudlow used a food analogy to explain how the problem is embedded in the internet. “It’s like saying, instead of telling people not to eat tacos, the problem is actually with some of the ground beef further up the supply chain, because there might have been some sick cows.”

Cayman government response

Cayman’s government, which relaunched its Cyber Safe campaign on 20 Oct., was quick to respond. A 22 Oct. press release noted that the government websites GOV.KY and myegov.ky operate on a platform that does not use PHP. However, it conceded that “other systems and services require individual assessment.”

“The Cayman Islands Government, through the Cyber Security Unit, eGovernment Department and Computer Services Department, is reviewing our environments for vulnerable systems and taking appropriate action,” stated the release.

The government release implored businesses to reach out to their IT teams and/or website hosting provider. But Sudlow said the response would vary depending on the nature of the company.

Smaller companies that don’t have their own cyber security teams “are beholden to whatever off-the-shelf application or software they’re using,” said Sudlow. “With larger companies, they have the resources to fix this, but it depends on their cyber security culture, whether they are proactive or not.”