Government agencies and commercial organisations in various countries have temporarily shut down their websites amid fears of cyberattacks after two serious security vulnerabilities were identified in the PHP programming language.
Cybersecurity experts have warned that exploiting these flaws could allow attackers to execute unauthorised commands on servers remotely without a password. The situation has raised questions about the security of government and private websites as well as online services in Bangladesh.
PHP is a widely used server-side programming language that handles various operations on the back end of websites.
These include processing user-submitted information, retrieving data from databases, verifying logins, managing online forms and displaying dynamic content on web pages. PHP is also used in popular content management systems such as WordPress.
According to cybersecurity firms, PHP is used by a vast number of websites worldwide, including news outlets, e-commerce platforms, government agencies and various online services.
In Bangladesh, the technology has also been used to develop numerous government and private-sector websites alongside web-based applications.
Bangladeshi cybersecurity experts say PHP was once one of the most widely used technologies for building websites. It gained popularity because it was relatively easy to learn and made it convenient to connect different parts of a website with databases.
However, the use of PHP does not automatically mean that a website has been compromised. The level of risk depends on the version of PHP being used, whether security updates have been installed and what other protective measures are in place on the server.
Junaid Miaje, CTO of private hosting company Limda Host, told Prothom Alo on Thursday that around 80 per cent of his company’s customers had PHP-based websites. After learning about the security vulnerabilities, they quickly applied the updated patches to their servers. So far, they have not detected any impact from the flaws on their systems, he said.
What risks have emerged?
According to a report by the international news agency AFP, citing cybersecurity firm Wiz, two serious security vulnerabilities have been identified in PHP. Attackers could exploit these flaws to execute unauthorised commands on servers. This could put files, databases and other information stored on the servers at risk.
The two vulnerabilities are related to PHP’s memory management. One could cause problems in the process of handling memory shortages. The other could allow outdated references to information that has been removed from memory to be used again. There are concerns that these weaknesses could be exploited to carry out unauthorised activities on servers.
As a result, simply strengthening a website’s login system or passwords cannot eliminate these risks. If a vulnerable version of PHP is being used, attackers may be able to exploit weaknesses at the server’s underlying software level.
According to AFP, several local government websites in France have been temporarily taken offline at the request of the country’s Interior Ministry. These include the Paris police website. In the Netherlands, the DigiD digital identity verification service, the House of Representatives and the National Cyber Security Centre’s website have also been taken offline as a precaution.
Belgium has announced that it has shut down its Foreign Ministry’s website. However, the country’s National Cyber Security Centre had not, at that point, recorded any incidents of attacks exploiting these vulnerabilities on any websites.
How secure are Bangladesh’s websites?
Officials involved in the development and maintenance of government websites under the government’s Aspire to Innovate (a2i) programme have said that websites managed through the National Portal system are not built using PHP. As a result, these websites are not expected to be directly exposed to the risks posed by the PHP security vulnerabilities.
A senior a2i official, speaking to Prothom Alo on condition of anonymity, said that after a global alert was issued over security vulnerabilities in PHP servers, they had put their own cybersecurity team on alert. Team members had already been informed about the issue so that they could take swift action if any risks emerged.
Meanwhile, people familiar with the sector said PHP is used in the private sector to develop websites and various web-based applications. As a result, the security flaws could affect different organisations and online services outside the government’s National Portal system.
Junaid Miaje, chief technology officer (CTO) of private hosting company Limda Host, told Prothom Alo on Thursday that around 80 per cent of his company’s customers had PHP-based websites. After learning about the security vulnerabilities, they quickly applied the updated patches to their servers. So far, they have not detected any impact from the flaws on their systems, he said.
Around 36,500 websites operate under the National Portal Framework. According to a2i officials, these websites are not built using the PHP programming language. However, various government departments and organisations have developed their own websites independently outside the framework. Which technologies have been used to build those sites is being checked.
What needs to be done to address the risks?
Cybersecurity experts say the immediate priorities are to identify vulnerable servers, ensure that security updates have been installed and check for signs of potential intrusion. Websites and critical digital services outside the government’s National Portal system must also be included in these checks.
Cybersecurity expert Tanvir Hassan Zoha told Prothom Alo that it was essential to compile a list of the PHP versions running on every government server to address the risks. Servers directly exposed to the internet should be prioritised for updates to patched versions.
The expert advised that, for PHP 8.1 and earlier versions, security updates from the relevant Linux distributions should be applied or the software should be upgraded to a newer version. Firewalls can be used to try to reduce the risks until updates are installed, but this is not a permanent solution. If a server cannot be updated, it should be temporarily disconnected from the internet.
CERT’s recommendations
BGD e-GOV CIRT, the government agency responsible for cybersecurity-related matters, has also issued an advisory on the PHP security vulnerabilities. According to the advisory, the organisations concerned should first compile a list of all the places where PHP is used on their servers. They should then check whether the versions in use are vulnerable to the flaws.
International reports have stated that developers of the PHP project have released security updates to fix the vulnerabilities. The organisations concerned should therefore install patched versions compatible with their PHP versions and operating systems. They must also ensure that the fixes have taken effect in the actual PHP runtime used to process website requests.
According to the CIRT advisory, if immediate updates are not possible, temporary measures may be taken to reduce risks. These include restricting internet access to vulnerable servers, allowing access only from specified IP addresses and monitoring unauthorised connections.