A new security vulnerability has been identified in PHP, putting more than 500 websites in Bangladesh at risk. These include websites operated by both government and private organisations. The government’s cyber security agency, BGD e-Gov CIRT, has issued a warning about the new vulnerability.
According to sources at the agency, more than 500 websites and apps are running older versions of PHP. Despite being warned, the operators have not updated their software. This has raised fresh concerns about the security of the country’s digital services.
PHP stands for “Hypertext Preprocessor”. It is a programming language that works in the background, or on the back end, of websites. A recent BBC report, citing cyber security firm Wiz, said PHP is used to run 70 per cent of websites worldwide.
Last week, a group of researchers from two US cyber security firms, Calif and Wiz, identified two vulnerabilities in PHP with the help of artificial intelligence (AI). On 21 October, the PHP development team released an urgent security update worldwide to fix the two serious flaws. On 23 October, the PHP authorities announced that another vulnerability had been identified.
The latest vulnerability is linked to PHP’s session management system and a specific feature used to track the progress of file uploads. Experts say attackers could exploit this weakness to execute unauthorised commands on servers.
Monitoring by CIRT’s Cyber Threat Intelligence Unit has identified more than 500 websites at risk. Most belong to private organisations. However, financial websites and government websites providing services of public importance are also exposed to the risk.
Meanwhile, CIRT issued a warning about the issue yesterday. It said a security patch for the new vulnerability had not yet been released. The affected versions and the severity of the risk had also not been determined.
In the meantime, the agency has advised the organisations concerned to temporarily disable PHP’s “session upload progress” feature, restart the necessary server services, review software configurations and monitor suspicious activity.
Over 500 websites at risk
The two serious PHP security vulnerabilities have raised concerns about cyber security worldwide. In Bangladesh, too, various websites were taken offline before being brought back online.
Monitoring by CIRT’s Cyber Threat Intelligence Unit has identified more than 500 websites at risk. Most belong to private organisations. However, financial websites and government websites providing services of public importance are also exposed to the risk.
Many people assume a website is secure simply because it is running. As a result, they neglect regular software updates and security fixes. Keeping security measures up to date, however, is essential.
Asked about the issue, CIRT Project Director Nazmul Haque Khandoker told Prothom Alo, “The risk will decrease if the websites are updated. However, the number of websites identified so far is concerning.”
Warnings being ignored
Several CIRT officials said government and private organisations are still using old, vulnerable versions of PHP on their websites. Even after receiving warnings, the organisations have not provided assurances that they will apply the necessary security fixes.
The officials also fear that sensitive information belonging to citizens could be stolen and that cyberattacks could occur.
Junaid Miazi, chief technology officer (CTO) of a private hosting company, told Prothom Alo that many people assume a website is secure simply because it is running. As a result, they neglect regular software updates and security fixes. Keeping security measures up to date, however, is essential.
Who is responsible for website security?
The National Cyber Security Agency and BGD e-Gov CIRT, which operates under the Bangladesh Computer Council, play roles in protecting the country’s digital infrastructure.
CIRT works to identify cyber threats and issue warnings about security vulnerabilities. However, questions remain about how effectively the authorities ensure that organisations address these weaknesses promptly after receiving warnings and properly follow security protocols.
Information technology expert Sumon Ahmed Sabir told Prothom Alo that responsibility for a website’s security rests with the organisation that operates it.
According to him, simply assigning responsibility is not enough. There must also be a system to check whether organisations are properly following security measures.
A national framework is needed to establish cyber security standards and ensure that they are being followed, he added.