Cybersecurity experts are urging local governments to address critical web vulnerabilities discovered last week that could allow hackers to take control of websites without needing a password.
The threat is related to two vulnerabilities in PHP, a software programming language commonly used for websites and online services, according to the League of Minnesota Cities. The U.S. Cybersecurity and Infrastructure Security Agency “strongly” urged organizations to patch the issues — nicknamed “php2shell” — immediately.
“Your city could be using PHP software directly or through a vendor,” LMC said in a blog post.
The Multi-State Information Sharing and Analysis Center on Oct. 19 categorized the threat to large and medium-sized local governments as high, and said smaller local governments face a medium-level threat.
CISA urged organizations to identify any version of PHP they are using and apply a patch, focusing on internet-facing systems first. If a patch cannot be made immediately, CISA recommended taking PHP-based systems offline until the fix can be made.
“A web application firewall may provide some protection until systems are updated or patched,” CISA said.
LMC recommends cities ask IT staff or contractors to scan for vulnerabilities and provide necessary updates and to check in with website and online-service vendors on PHP patch statuses.
“Contact all vendors handling public websites, utility billing, payments, permits, or sensitive information,” LMC said.
If hackers exploit one of the identified vulnerabilities, they could secure the ability to install programs, view and alter sensitive data or create new accounts, MS-ISAC said.
The vulnerabilities are among the most severe discovered in PHP and "arguably in software history,” one of the security firms that discovered the issues wrote in a blog post, Cybersecurity Dive reported.
If a cybersecurity incident is suspected, LMC said cities should avoid deleting files or wiping systems to allow IT to preserve evidence.
“Ask staff to stay on alert and report any unexpected website changes, unusual payment links, or unexplained service behavior to your IT provider or vendor,” the municipal organization said. “If a cyber incident is suspected, follow your city’s incident response and notification procedures.”
