Critical PHP security fix released: Dutch agency warns websites may need hours to return

The developers of the PHP programming language released two patches to fix “critical vulnerabilities” discovered this week. The vulnerabilities made it possible for anyone with malicious intent to remotely take control of websites, and potentially servers.

Due to the vulnerabilities, many sites were temporarily taken offline on Wednesday, including NL Times. The National Cyber ​​Security Centre (NCSC) warned that not all websites would be able to return online right after the patches were made available at about 4 p.m. on Wednesday.

These were created to close the vulnerabilities, which became more widely known due to a viral video. It was expected that many sites will be able to come back online afterwards.

For some sites, patching was likely to take a matter of minutes. For others, it could take hours, said the NCSC, an agency within the Ministry of Justice and Security. In some cases, websites may need even more time before they can return online. The NCSC was expected to publish an advisory within an hour of the patch’s release.

“Some websites can flip a switch, but for others it may take longer. Depending on which version they are using,” said NCSC Deputy Director Corine Schipper-Derkse during a press briefing on Wednesday. In any case, she said it was “crucial that everyone” implement the patch, so the software vulnerability can be fixed.

It is also possible that a new patch will be made available later, should the first one fail to resolve all issues, she said. Schipper-Derkse believes that most major organizations acted prudently on Wednesday. “The vulnerability is so widely known, they know it exists.”

However, she continues to emphasize that it is the responsibility of companies to protect their own vulnerable systems. “It is up to organizations themselves to assess the risks and take the systems offline if necessary.” The center already advised making preparations so that the patch can be installed as soon as it becomes available.

She also did not see a situation in the Netherlands where organizations or people panicked about the incident. A similar level of concern was seen in other countries, and her European counterparts were also working on the issue, as were European cybersecurity services.

The message regarding the vulnerabilities was leaked in this case, Schipper-Derkse added. “The moment you become aware of a vulnerability, you want to wait until the patch is ready before it becomes public. That was not the case. As a result, every minute counts, and at the same time, there is another option: namely to take sites offline where a risk analysis points to that.”

Such a flaw in the software could have been present “for ages,” she said. This is why checks are continuously carried out to see if updates are needed, just as is done with mobile phones, for example. Consequently, it is quite possible that organizations may have been at risk for some time, she confirmed to journalists when asked.