Portuguese councils and hospitals among 29 public bodies running outdated website software
A consultancy found unsupported PHP versions on public-sector sites as an international alert spread over two critical flaws, Portugal Resident reported.
Councils and hospitals are among 29 Portuguese public bodies found to be running outdated website software during an international security alert, according to Portugal Resident. The outlet cited reporting by Expresso and SOL.
The alert concerns two critical flaws in PHP, software that runs websites and online services behind the scenes. Portugal Resident reported that the flaws could let attackers run their own code on affected servers without logging in, which could expose information or compromise services. PHP's developers released security updates on Wednesday and urged users to install them immediately.
Cybersecurity consultancy Cybers3C examined 223 websites belonging to public bodies and services in Portugal. Its chief executive, Sérgio Monteiro e Silva, told Expresso that 29 organisations, including councils and hospitals, were using versions that are no longer supported. One state body's website indicated it was running a version from 2006, the report said.
Some Portuguese websites were taken offline temporarily on Wednesday as a precaution, and organisations began updating their systems after fixes became available that afternoon. Checks at around 8.30pm still found sites waiting for updates. A later review again identified 29 public bodies using unsupported versions, although Monteiro e Silva said some councils and services had acted quickly.
Why it matters
Both vulnerabilities were rated 9.2 out of 10 for severity. Because PHP handles requests and delivers services, a flaw in it can create a route into a server even when the website seems to work normally. The developers warn that updating is the only complete fix and that temporary protective measures do not make affected installations safe.
For organisations on older systems, a routine update may not be enough. PHP's developers advise checking whether suppliers provide security fixes for older versions, or moving to a supported release.
Portugal's National Cybersecurity Centre has advised organisations to identify all PHP installations, prioritise systems reachable from the internet and check with hosting companies and software suppliers for updates, according to SOL. Where there are signs of intrusion, its recommendations include isolating the server, preserving technical records and looking for suspicious files or newly created accounts.
SOL also reported that the alert prompted precautionary shutdowns of public service websites in Finland, Denmark, the Netherlands and Belgium.
What is not known
The 29 organisations have not been named. Portugal Resident stressed that the findings point to a security risk and do not show that any of those bodies have been hacked. The report does not say how many of the affected sites have since been updated, or when all of them are expected to be secured.
