PHP flaw could leave websites exposed for years

A serious vulnerability in PHP has exposed many websites to security risks, and repairing the damage could take years, ORF reported. An update is available, but experts warn that older PHP versions have no fix.

Websites including Johannes Kepler University Linz and the Upper Austria fire brigade command’s operations website suddenly went offline after the flaw came to light on Wednesday. PHP is widely used to build websites and web applications, including online shops and news portals.

IT expert Dieter Vymazal of the Hagenberg University of Applied Sciences said the risk could also extend to internet users. Attackers could compromise websites, alter their content or upload malware. Visitors could then be at risk if they click on links or download files.

Vymazal said PHP runs on about two-thirds of websites and that versions released in recent years were vulnerable. He warned that it could take years to repair all weaknesses, as some servers are difficult to take offline. Large operators and websites may be able to address the problem within days.