Cyber security centre warns PHP hacking situation could worsen

The Netherlands’ National Cyber Security Centre (NCSC) is investigating the first signs of successful hacks on websites following the exposure of critical vulnerabilities on the web, and says the situation could “rapidly worsen”.

A spokesperson told the Volkskrant on Thursday that the signals came from the NCSC’s international network, and that there was no sign yet of abuse involving Dutch websites. The centre is still checking whether the reports are accurate.

Cybersecurity researchers, working with the help of AI, found that PHP, the programming language on which a majority of the web is built, had at least two serious vulnerabilities in its code.

Details of the weaknesses were leaked online on Monday, and the PHP developers announced they would issue an upgrade by Wednesday afternoon.

Hacking attempts began even before the leak, with Amazon reporting an attack attempt on October 17. US internet security firm Cloudflare said it saw hacking attempts run from thousands before the upgrade to millions afterwards.

Initially, the NCSC said that there were no signs of active hacks and the PHP developers said there were no indications of breaches.

Large amounts of government, healthcare and news sites were forced to go dark temporarily while awaiting the upgrade, including Dutch News.

The Netherlands was fast to act, closing a large amount of its sites and issuing warnings early on Wednesday, after which governments in Belgium, Germany, France and Finland did the same. The issue is now a global concern.

Dutch privacy watchdog AP said on Thursday it had not yet received any reports of data breaches linked to the vulnerabilities.