Estonian cyber expert: PHP flaws did not cause a crisis

Agencies and service providers in several countries have temporarily closed websites because of security holes in PHP software, but Taavi Kupper, head of incident handling at the cybersecurity centre of Estonia’s Information System Authority (RIA), says this is not a crisis. He said the closures were driven mainly by precautions and the installation of software updates, rather than by cyberattacks.

Kupper explained that PHP is server-side software that lets websites and web services do their work. In an online shop, a visitor sees products, prices and a basket, while PHP handles the background tasks between the server and the web application, including looking up prices, checking stock, calculating the basket and saving the order. PHP has been used in web development for decades and runs about 70 percent of internet pages.

Versions 5 through 8 are vulnerable, but Kupper said a security fix can be installed only by users of version 8. For versions 5 to 7, he said it remains uncertain whether any update will come at all, so those users now need other mitigating or technically temporary measures.

The two discovered holes allowed entry into the environment where the software was running without knowing a username or password. Customers were not directly vulnerable, but the whole website system, the service running on it and the data inside it were.

The vulnerabilities were announced on Wednesday and a software update was released. At the same time, service providers around the world took their websites offline temporarily. Kupper said owners may have taken sites down preventively because they did not know how to respond for their version, or because updating PHP required a restart. He said a restart can take from a few minutes to a few hours depending on the system and the chain, which is why services were down. Services may be intermittently unavailable, and the mass taking down and bringing back up is tied to the ongoing update process. He said the vulnerabilities themselves did not cause malicious activity to pull the sites offline.

Sites were closed temporarily worldwide on Wednesday. In Latvia, the national broadcaster’s LSM portal was even offline. In Estonia there were disruptions, for example in the work of the National Archives, and on Thursday the Ministry of Education said it was temporarily stopping the Moodle learning environment. Compared with the rest of the world, Estonia had relatively few disruptions.

Kupper said Estonia is small, information moves quickly and mitigation was applied immediately. He added that this does not mean Estonia was left completely untouched: many people in Estonia are directly or indirectly connected to PHP and the vulnerability, and outages and unavailable services have occurred in Estonia too. He said the country was fortunate that the focus was not on such critical services.

Advance warnings and analyses pointing to the vulnerabilities began arriving from August, Kupper said. From then until now there were discussions, hints and suspicions. The issue was fully realised when a security patch was released, and that patch immediately revealed a wide-ranging hole. He said that was one reason the existence of the hole was not made public very quickly: it is very widespread, and producing the patch took time.

OpenAI, whose technology helped find one of the bugs, called the discovery one of the security problems with the widest impact in the recent past. The security company Wiz independently found the second vulnerability.

Kupper said that with various AI and other tools it is now very easy to exploit even hard-to-find holes. Because of code analysis and AI language models, he said, finding vulnerabilities of different levels in older devices will certainly increase, including malicious discovery. He cited a hacker attack on French retail chains in which attackers changed refrigerator temperatures. That vulnerability had been known and open for years until someone found and used it. He said software developers, service users and other technical people should regularly strengthen their code analysis with language models, and that the initiative cannot be left only to the opposing side.

People now use cloud services on a large scale, from family photos to storing sensitive work data. Kupper said this is not secure. He rejected the idea that the cloud and security go together in proportion, saying a cloud has from the start been someone else’s computer under someone else’s rules, and that the cloud is more a matter of convenience than of security. He said he would not keep critical and vital things, professionally or privately, on someone else’s computer.

Kupper said there is no reason to panic and that this is not a crisis. He described it as the new normal: such things happen and simply have to be solved. He said it is very good that service providers have reacted. An ordinary user may see that a service cannot be reached and that everything appears to be down in complete chaos, while in fact people and providers are responding and updating.