Experts split over risk to users after PHP vulnerabilities

Experts disagree over whether hackers accessed personal data after two serious vulnerabilities were found in PHP, software used by up to 70 percent of websites. Amazon, Copenhagen Municipality and Aula temporarily shut down systems to address the flaws, DR reports.

Anders Møller, a computer science professor at Aarhus University, said there was no evidence hackers had accessed data in the affected systems. Amazon is the only company to have reported attempted attacks so far; those attempts took place four days before the vulnerabilities were announced, and the company has not said they succeeded or that data was leaked.

Møller said Danish organisations acted quickly after the warning. He added that the vulnerabilities could have exposed personal data if Aula had not responded promptly.

Jens Myrup, a cybersecurity professor at Aarhus University, said the flaws were found by security researchers seeking to prevent attacks, with help from artificial intelligence. The warning was coordinated with the release of a fix, he said.

But Jan Kaastrup, an IT security specialist at CSIS Security Group, described the flaws as exceptionally serious and said he believed some websites had been hacked before they were patched. He said the likelihood of exploitation increased the longer it took organisations to close the vulnerability.

Sofie Freja Christensen, a cybersecurity expert at the IDA engineers’ trade union, advised organisations to shut down affected systems, update PHP and check for suspicious activity. She said systems that have been updated and checked should be safe, but was concerned that some companies might not have taken the threat seriously.

PHP is used in systems including WordPress, Drupal and Joomla, as well as online shops, intranets, customer portals and booking systems. Møller also urged people to keep their personal computers and phones updated.