Hong Kong organisations have been urged to check their systems for serious PHP vulnerabilities, install the available fixes promptly and take affected systems offline or isolate them if they cannot be patched. The Digital Policy Office issued an alert to government bureaux, departments and public organisations to review their information systems, while also urging the public and organisations to patch affected systems.
PHP is an open-source language that runs on web servers, processing data and connecting to databases to generate website content. It underpins platforms including WordPress and is used by e-commerce and business systems.
The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) rated the vulnerabilities extremely high risk in an advisory on 22 October. It recommended patching all affected assets immediately; where that is not possible, organisations should isolate internet-facing applications from the public network until a fix has been applied and verified.
The Digital Policy Office said it had completed repairs to the hosting service for government bureaux’ and departments’ homepages. It also said it had received no reports of related cybersecurity incidents as of its statement.
Ming Pao reported that PHP’s development team released updated versions on 21 October and urged users to update. Organisations seeking assistance can contact HKCERT at hkcert@hkcert.org or on 8105 6060.