A VULNERABILITY within a programming language that sparked global disruption has highlighted a “key” cybersecurity issue, according to the head of the team spearheading the Island’s digital defences.
Matt Palmer, director of the Cyber Security Centres in Jersey and Guernsey, urged Islanders affected by website downtime to be “patient” after organisations around the world rushed to temporarily take sites down to ensure their security.
The impact was felt across a range of digital services, including some online forms utilised by the Government of Jersey – which stated yesterday morning that its teams were working to restore them “as soon as possible”.
Mr Palmer explained that the disruption stemmed from a PHP vulnerability that was discovered by AI.
PHP is a scripting language used by many websites, as well as website management platforms like WordPress.
“It’s not something that most users will have heard of, but it’s key infrastructure that underpins the websites we use every day,” explained Mr Palmer.
“This incident has happened because a weakness in PHP allowed attackers to access website servers and steal information.”
He noted that this could include contact details, personal information and banking details.
“Because this is such a serious risk, we saw many organisations take down their website to fix the vulnerability before it could be exploited,” Mr Palmer continued.
“This is what led to the disruption of many websites.”
He described the vulnerability as “a good example of how cutting-edge risks and long-standing issues meet in cyber security”.
“The vulnerability was only found using AI,” added Mr Palmer. “At the same time, it highlights a key issue that both JCSC and GCSC talk about regularly: patching.
“PHP have released an update (known as a patch) that will fix the vulnerability. Any organisation running a website using PHP should take down the website and apply the patch as a matter of urgency.
“This is why regular patching is important, and why applying critical patches – like this one – is vital.”
The JCSC director urged Islanders affected by website downtime to be “patient”.
“Organisations are taking down websites to keep them secure, and to ensure users’ information is secured,” said Mr Palmer.
“While the disruption might be frustrating, it’s a sign that organisations are acting responsibly. While it is far from ideal, a quick response benefits us all.”
