PHP cybersecurity risk: What is it and who is at risk?

In the past 48 hours, you may have noticed a number of websites were down for unscheduled maintenance or temporarily unavailable.

That’s due to the discovery of a cybersecurity weakness found in PHP code, which is used across the internet, including the Government of B.C.’s official channels, your local library portal and educational institutions.

In light of recent cybersecurity attacks such as those on the Burnaby School District and the Save-on-Foods More Rewards program, here’s what you should know.

PHP stands for Hypertext Preprocessor, which is an open source scripting language used on the server-side of many websites.

Recently, news emerged that white hat researchers, also known as ethical hackers, had discovered a weak point in the PHP language back in 2024.

According to Karthik Pattabiraman, a University of B.C. professor specializing in cybersecurity, the vulnerability was ignored at the time as it was considered too difficult to exploit.

“Nobody paid attention to it,” said Pattabiraman. “But recently, with the advent of AI models … and human help, they discovered that this vulnerability could actually be exploited.”

After researchers found that exploitation of the flaw was possible, they confidentially contacted the PHP Foundation, a non-profit group that maintains the language, and notified them of the discovery.

The group then quickly developed an update that would close the security gap. This week, the update was released to developers.

“They had two months to work on a patch and release it so, fortuitously, due to the preparation done, it worked out that the defenders got ahead of the game here,” said Pattabiraman.

Because a fix is now readily available, Pattabiraman said it’s a simple case of web developers updating their websites with the latest version of PHP.

“It’s relatively straightforward for administrators to apply the patch and fix and, in fact, many have already done so.”

Pattabiramn says PHP is used on the back end of approximately 70 to 75 per cent of websites. Many of the major institutions you interact with daily will have websites that rely on PHP scripts to run.

On Wednesday, the Government of B.C. shared that its websites and services would be temporarily offline “as a precaution.”

“Teams are working to restore services as soon as possible,” the post read.

The B.C. Institute of Technology, where winter semester registration is underway, also paused its registration on Wednesday for unscheduled maintenance.

Pattabiraman said there are no known cases of the vulnerability being exploited at this time but says if it had been discovered by bad agents, it could have led to the loss of important data or websites being defaced or taken down. Other risks include the theft of credentials or phishing attacks.

“We were ahead of the game. Maybe the next time this happens, it may not be the case,” he cautioned. “So it’s super important to make sure we invest, as a society, in finding and fixing vulnerabilities proactively so that the software we depend on is actually secure.”

The PHP vulnerability is an issue with the scripting language itself, not an application or a website specifically, and not something everyday internet users need to worry about right now.

“It’s not something that is due to weak passwords or any of the usual things that end users can take precautions against,” said Pattabiraman. “Rather, this is more about website administrators upgrading or patching their PHP versions, upgrading their website software.

“So from that perspective, this is not something that the average person can fix. However, I think it’s important to know if you’re running your own website, let’s say you’re a small-business owner, then it’s important to make sure you patch your software, to keep it up to date.”

That said, Pattabiraman says it’s key for internet users to practice good cyber hygiene, such as using different passwords for different websites and updating them regularly.