Hong Kong authorities have “attached great importance” to two critical flaws in a widely used web programming language that could allow hackers to execute code remotely and take control of servers.
The government’s Digital Policy Office said on Thursday that it had issued a security alert to all bureaus, departments and public organisations requesting an immediate and comprehensive review to determine whether their information systems were affected.
“[They must] complete all patching work as soon as possible; otherwise, the relevant systems should be temporarily taken offline or isolated to reduce the risk of malicious intrusion,” it said.
The actions came after a local information security watchdog earlier issued an “extremely high risk” warning, following similar alerts from governments and cybersecurity agencies overseas, urging website operators to install updates to fix the vulnerabilities in the PHP programming language.
The office said it had completed the required system patching work for the website hosting services that hosted the homepages of all government bureaus and departments.
It said it had not received any reports of related cybersecurity incidents so far, while urging the public and organisations to immediately install patches for all affected systems.
The Hong Kong Computer Emergency Response Team Coordination Centre earlier said a remote attacker could exploit the vulnerabilities to execute code on a targeted system.
The government-funded group advised organisations to install the patches immediately.
“If immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until the security fixes are applied and verified,” the centre said.
OpenAI said in a social media post on Wednesday that its artificial intelligence models had helped researchers discover the PHP flaws.
The PHP development team urged users to update the programming language immediately to fix the two critical vulnerabilities, each given a severity rating of 9.2 out of 10.
Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, said WordPress, the world’s most widely used content management system, relied heavily on PHP, as did various e-commerce and enterprise portals. He said the flaws could affect popular websites used by the public.
Fong said that when a user clicked a button, filled in a form or logged into an account, PHP running on the server processed the data, connected to databases and generated webpage content in real time.
He urged website administrators to install the patches immediately.
“If exploited, hackers can gain direct control of servers, posing a severe security threat to both enterprise and personal websites,” he said.
The United States Cybersecurity and Infrastructure Security Agency on Wednesday strongly urged organisations to address the problem immediately, noting that while it “has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organisations if left unpatched”.
The US Federal Bureau of Investigation’s Cyber Division also urged organisations to install the updates immediately.
“If an immediate update is not feasible, it is recommended that organisations take the system offline until it can be fully mitigated,” it said.
Britain’s National Cyber Security Centre also recommended updating to the latest version of PHP and continuing to monitor for updates.
The Cybersecurity Service for the Union Institutions, Bodies, Offices and Agencies – the cybersecurity service for the European Union – also “strongly recommended” an update.
China’s National Vulnerability Database also recommended an update, describing the risks as critical.
Finland temporarily shut down the government’s public web services, while the Netherlands’ cybersecurity agency said it was taking its own website offline because of the vulnerabilities, according to the BBC. -- SOUTH CHINA MORNING POST
