PhoneWorld · রাজনীতি

Critical PHP Security Flaws Put Government Portals, Websites and Banks at Risk: National CERT

২৩/১০/২০২৬

Pakistan’s National Computer Emergency Response Team (National CERT) has issued an urgent cybersecurity advisory warning government departments, financial institutions, and private organizations about two critical security vulnerabilities affecting PHP-based systems.

According to the advisory, both vulnerabilities carry a severity score of 9.2 out of 10, indicating serious security risks for organizations operating vulnerable web applications and online services.

National CERT has circulated the warning to federal ministries, government departments, regulators, public-sector companies, financial institutions, and ICT service providers, urging them to implement immediate security measures.

The vulnerabilities could potentially allow attackers to execute malicious code remotely without requiring user authentication or prior authorization. Attackers may exploit the weaknesses by sending specially crafted HTTP requests to vulnerable systems.

This raises concerns for government web portals, financial platforms, business applications, and other critical information systems that rely on affected PHP environments.

The advisory also highlights reports of early exploitation-related activity internationally, suggesting that organizations should not delay preventive action.

How Could These PHP Vulnerabilities Affect Pakistani Websites?

PHP is a widely used programming language that powers numerous websites, online portals, and web-based applications. Security weaknesses affecting vulnerable PHP deployments can therefore have implications for organizations that depend on these systems.

According to National CERT, the identified vulnerabilities could allow attackers to execute unauthorized commands on affected servers, potentially compromising sensitive information and disrupting essential digital services.

Government websites, financial institutions, and business applications could be particularly vulnerable where affected systems are exposed to the internet and appropriate security measures have not been implemented.

The advisory warns that malicious HTTP requests could be used to exploit the weaknesses remotely, making internet-facing systems an important priority for security teams.

However, the presence of PHP on a website does not automatically mean the website is vulnerable. Actual exposure depends on the affected software versions, server configurations, and whether appropriate security fixes have been applied.

National CERT Calls for Immediate Security Measures

To reduce the risk of potential cyberattacks, National CERT has directed organizations to identify all internet-facing PHP systems and assess their exposure to the reported vulnerabilities.

The advisory recommends deploying available security patches and updates for affected systems as soon as possible. Where immediate fixes are unavailable, technical teams should prepare emergency updates and apply appropriate temporary protections.

National CERT has also advised organizations to strengthen their defenses through Web Application Firewalls (WAFs), which can help detect and block suspicious web requests.

Security teams have been instructed to closely monitor system logs, investigate unusual activity, and look for signs of unauthorized access or suspicious web shells that could indicate a compromised server.

Any suspected intrusion or malicious web shell activity should be reported immediately to National CERT Pakistan to support timely investigation and coordinated incident response.

The advisory underscores the importance of regularly updating web infrastructure, monitoring critical applications, and maintaining effective cybersecurity controls. With government services, financial transactions, and business operations increasingly dependent on online platforms, weaknesses in widely used web technologies could create serious risks if affected systems are left unpatched.