NEW ZEALAND BUSINESS NEWS
Empowering Kiwi Businesses
Businesses are being asked to determine whether PHP, a coding language that underpins a large share of the world’s websites and web-based services, is present in their systems and to ensure the latest security updates have been applied. The National Cyber Security Centre issued the warning after vulnerabilities in the language were disclosed.
The stakes are high for any organisation that sells, books or publishes online. According to the agency, an attacker exploiting the flaw could gain full control of a website, a web server or a web service. That opens the door to site defacement and outages, either of which can interrupt trading and damage a brand.
PHP sits behind many content management systems, WordPress among them, so a business that has never written a line of code can still be running it. The agency also points to two other common routes to exposure: a website or online service hosted by a third-party provider that uses PHP, and web applications built on the language.
That means the job often falls outside a company’s own technology staff. Businesses that outsource web development or hosting need confirmation from those suppliers that they have installed updates and carried out checks for signs of compromise.
Organisations that are unsure whether PHP is involved at all are being directed to their website developer, IT provider or hosting company for a straight answer.
The agency has set out what businesses should ask their providers. First, ask whether the latest PHP security update has been installed. The second is whether any of their systems are affected by the vulnerability. The third is whether they checked for compromise before patching, and the fourth is whether anything else is needed to secure the systems.
Where an update cannot go on immediately, the agency says businesses should ask what temporary measures are in place to reduce the risk in the meantime. That reflects a familiar constraint in incident response: patching is not always instant, whether because of operational demands, reliance on a third party or compatibility concerns.
Installing the update should not be treated as the end of the exercise. The agency wants providers to look for evidence that someone already accessed or altered a system before the patch went on.
The warning signs it lists are unexpected changes to a website, the creation of new administrator accounts, outages, poor performance, and unusual login or system activity. Those checks help a business determine whether the flaw was used against it before it was closed.
The agency has said it is too early to judge the full impact of the vulnerabilities on New Zealand organisations. Its stated priority for businesses is to confirm whether they are affected and to see that the right updates and checks are completed.
For an SME without in-house technical staff, the practical effect is a short list of questions to send to whoever runs the website, and a request for a written answer. A supplier that cannot say whether PHP is in use, or whether the update has gone on, is itself a risk worth knowing about.
Business owners should also expect a follow-up conversation about what was found when the system was checked for tampering. A clean patch on a site that was quietly altered weeks earlier leaves the intruder’s access in place.
One group can stand down. The warning is aimed at businesses and service providers, not the public. Internet users need take no action simply because they have visited a site built on PHP, and doing so does not put phones or home computers at risk, because the flaw sits in the systems that deliver website content and services.
NZ Business News reports on the decisions, deals and numbers shaping New Zealand business — the companies making them, the policy and market conditions they work within, and what it means for the people running businesses here.