Hong Kong orders urgent checks as critical flaws put websites at risk of hacking

A Hong Kong information security watchdog issued an “extremely high risk” warning on Thursday morning over two critical flaws in a widely used web programming language that could allow hackers to execute code remotely and take control of servers.

The warning followed similar alerts from governments and cybersecurity agencies overseas, which urged website operators to install updates to fix the vulnerabilities in the PHP programming language.

The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) said a remote attacker could exploit the vulnerabilities to execute code on a targeted system.

The government-funded group advised organisations to install the patches immediately.

“If immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until the security fixes are applied and verified,” HKCERT said on its website.

The South China Morning Post has contacted the Hong Kong government’s Digital Policy Office to ask whether authorities have taken corresponding action.

OpenAI said in a post on X on Wednesday that its artificial intelligence models had helped researchers discover the PHP flaws.

The PHP development team urged users to update the programming language immediately to fix the two critical vulnerabilities, each given a severity rating of 9.2 out of 10.

Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, said WordPress, the world’s most widely used content management system, relied heavily on PHP, as did various e-commerce and enterprise portals. He said the flaws could affect popular websites used by the public.

Fong explained that when a user clicked a button, filled in a form or logged into an account, PHP running on the server processed the data, connected to databases and generated webpage content in real time.

He urged website administrators to install the patches immediately.

“If exploited, hackers can gain direct control of servers, posing a severe security threat to both enterprise and personal websites,” he said.

The US Cybersecurity and Infrastructure Security Agency on Wednesday strongly urged organisations to patch the critical PHP vulnerabilities immediately, noting that while it “has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organisations if left unpatched”.

The FBI’s Cyber Division also urged organisations in a post on X to install the updates immediately.

“If an immediate update is not feasible, it is recommended that organisations take the system offline until it can be fully mitigated,” it said.

The UK’s National Cyber Security Centre also recommended updating to the latest version of PHP and continuing to monitor for updates.

The Cybersecurity Service for the Union institutions, bodies, offices and agencies, the EU’s cybersecurity service, also “strongly recommended” an update.

Finland temporarily shut down the government’s public web services, while the Netherlands’ cybersecurity agency said it was taking its own website offline because of the vulnerabilities, according to the BBC.