Hong Kong cyber security centre urges organisations to audit all PHP systems after critical flaws found
Hong Kong’s cyber security coordination centre has called on businesses and institutions to conduct a comprehensive audit of all products and services that may use PHP, after two critical vulnerabilities were patched. The flaws could allow remote attackers to execute unauthorised code, and the risks
Hong Kong’s cyber security incident coordination centre has urged local businesses and institutions to conduct a full inventory of all systems that may use PHP, after the PHP security team released an emergency update to patch two critical vulnerabilities. The flaws could allow remote attackers to execute unauthorised code, and affected PHP systems must be updated as soon as possible.
The centre highlighted that the potential risks from these vulnerabilities are not limited to general web servers. Many enterprise applications, network and security devices, storage and surveillance systems embed PHP in their management consoles or operational components. The version of PHP embedded in such equipment may not match the version shown by the operating system, creating a blind spot in enterprise network security management.
Institutions should therefore not only check their web servers but immediately conduct a comprehensive audit of all products, services and external-facing systems that may use PHP. They should proactively contact suppliers to confirm the scope of the impact and arrange for patches.
The centre also noted that the incident reflects how artificial intelligence is accelerating the speed of cyber security attacks and defences. According to publicly available information, the PHP vulnerabilities were discovered as early as August this year by security researchers using AI technology, who then reported them to the PHP team for patching.
The centre called on organisations to take multiple countermeasures, including auditing all systems running PHP across the organisation, with particular attention to internet-facing servers, and upgrading PHP to the patched version.