New Zealand organisations have been urged to establish urgently whether websites, online services or software suppliers rely on PHP after critical security vulnerabilities were disclosed in the widely used programming language.
The New Zealand National Cyber Security Centre said the flaws could allow an attacker to take full control of a website, web server or web service. That could include defacing a site, taking it offline or gaining access to the system that delivers it. The agency has not said that New Zealand organisations have been compromised, and on 23 October said it was still too early to determine the full domestic impact.
The advice follows a patch release for affected supported versions of PHP. On 22 October, the centre recommended that organisations apply security updates immediately and consider disabling public-facing web services if a prompt update was not possible. It said a patch does not remove an attacker from a system that may already have been compromised, so checks for unusual activity remain part of the response.
What businesses have been asked to check
The centre’s follow-up advice is aimed particularly at smaller businesses that may not know how their websites or online services are built. PHP can sit behind a content-management system, a web application or a service supplied by a hosting company. A business may therefore be affected even if it has not installed or managed PHP itself.
Firms uncertain about their exposure have been told to contact their website developer, IT provider or hosting company. They should ask whether their site or service uses PHP, whether the relevant update has been applied, whether systems have been examined for signs of compromise before patching, and whether any further security work is needed.
That focus on suppliers matters because an update to the underlying language may require further action by the provider of a product, operating system or hosted service. The centre said the standard update protects actively supported PHP versions. Older versions that have reached end of life can remain vulnerable unless a team receives a supported backport or applies a suitable custom fix.
Patching is not the end of the response
The vulnerabilities can allow remote code execution without authentication on affected PHP systems serving web requests. In practical terms, an attacker may be able to run code on a server without first having a valid account. That is why the centre has stressed both rapid patching and checks for activity that could indicate a system was affected before the update was installed.
The warning points providers towards unexpected changes to websites, new administrator accounts, outages or poor performance, and unusual login or system activity. These signs do not by themselves prove an intrusion, but the agency said they should be reviewed as part of a proper response rather than treated as a reason to delay updating.
Where a fix cannot be applied straight away, businesses should ask providers what temporary measures are in place to reduce exposure. The centre has said organisations considering mitigations should assess whether they work against the risks in their own environment and continue to monitor them. Taking an internet-facing service offline may be appropriate where the alternative is leaving an exposed system unpatched.
Advice for people using websites
The alert is directed at the organisations that run websites and online services, rather than at people who simply use them. The centre said internet users do not need to take action solely because they have visited a website that uses PHP. Visiting such a site does not, by itself, place a phone or home computer at risk under this advisory.
For businesses, the immediate question is not whether PHP is visible on a website, but whether the systems delivering its content or services are affected and have been updated. The National Cyber Security Centre said confirming that position with relevant providers, applying the necessary fixes and checking for suspicious activity should be treated as priorities while the scale of any impact in New Zealand remains unclear.
