Around 100 Lithuanian websites vulnerable to critical PHP flaw, cybersecurity chief says

Around 100 websites in Lithuania have been identified as vulnerable to a critical flaw in PHP, a programming language used by an estimated 80% to 90% of websites in the country, the head of the National Cyber Security Centre said Thursday.

Antanas Aleknavičius told M1 radio that the affected sites included those operated by private businesses and state institutions. The centre is conducting further scans to determine the full extent of the vulnerability.

Authorities rated the severity of the threat at 9.5 out of 10 and notified institutions in advance, he said.

The National Cyber Security Centre issued a warning Wednesday following international reports of a global vulnerability in PHP code. In response, the Centre of Registers temporarily suspended some services, announcing Thursday that they were being restored.

Aleknavičius warned that failure to address the flaw could leave websites and their servers exposed to attacks, potentially disrupting information systems. The extent of the damage would depend on existing security measures and the data stored on affected sites.

Some websites might need only software updates, while others could require more extensive reconstruction, he said.

Tools to exploit the vulnerability are being developed, but there is currently no evidence they have been used, Aleknavičius added.

Antanas Raguotis, IT director at the Centre of Registers, said exploiting the flaw could enable unauthorised access to systems, allowing attackers to alter or steal data and take control of affected systems. An investigation into the incident will be conducted.

Raguotis also warned of a critical vulnerability in Java, another widely used programming language, announced by Oracle. The Centre of Registers is assessing the potential impact on its systems and is awaiting international recommendations before deciding whether further precautions, including suspending services, are necessary.

He said advances in artificial intelligence were making it possible to identify and exploit software vulnerabilities much faster, potentially increasing the scale of cyberattacks.

When new technologies emerge, tools to exploit them are often developed before effective defensive measures become available, Raguotis said.