CERT.LV: Outdated PHP versions in the public sector are unacceptable
After two critical vulnerabilities were found in the PHP programming language, many websites in Latvia had their operation restricted. The deputy head of CERT.LV stresses that old versions must not remain in use in the public sector.
Last week, many websites in Latvia and elsewhere in the world had their operation restricted, including several state and municipal sites. The aim was to prevent possible cyberattacks after two critical security vulnerabilities were discovered in the PHP programming language. Most of the resources became available again within a few days, but the episode drew attention to another problem: the use of outdated software.
On the programme "Spried ar Delfi", Varis Teivāns, deputy head of CERT.LV, the institution that deals with cyber incident prevention in Latvia, said that very old PHP versions have been found in the public sector and are still used in production. In his view, this is unacceptable. At the same time, Teivāns acknowledged that updating such systems can require staff resources and considerable time, from several weeks to even months.
How widespread PHP is
According to estimates by the cybersecurity company Wiz, PHP is used on roughly 70% of the world's websites. For that reason, vulnerabilities in the language can affect a very large number of resources at once.
Asked why PHP is so widespread, Deniss Čalovskis, a lecturer at the BDA training centre, said he does not work with the language himself. On the programme he also spoke about what promotes its use in Latvia.
