AN ATTACKER COULD GET IN WITHOUT AN ACCOUNT

PHP helps a website process requests and produce the pages people see. The newly disclosed flaws can, under certain conditions, let an outsider run commands on the server without first signing in.

That puts the computer running the website at risk. Depending on what the attacker can reach, a successful break-in could expose information, change content or interrupt a service.

The PHP Foundation confirmed that researchers had demonstrated attacks that could run code on affected systems. The PHP team released fixes for its supported versions and told operators to update.

Changing your own password does not repair this software problem. The people running the website and its hosting service have to do that work.

A SECURITY WARNING DOES NOT PROVE A WEBSITE WAS HACKED

In its October 22 update, Singapore's Cyber Security Agency reported widespread attempts to exploit PHP2Shell. That is evidence of attackers trying, not proof that every attempt succeeded.

The official advisories reviewed for this article do not identify a Philippine government website confirmed to have been breached through these flaws.

A website going offline does not settle that question either. It may have been taken down for repairs, or it may have another problem. Likewise, a page that still opens normally tells visitors very little about the security of the server behind it.

Agencies should say what they have checked and what remains under investigation. Readers should be cautious about posts declaring a government-wide breach without evidence.

PERSONAL INFORMATION CAN BE EXPOSED EVEN IF THE MAIN DATABASE IS INTACT

PhilHealth's September 2023 ransomware attack is a separate, documented example.

In its October 2 notice that year, PhilHealth said its main database remained intact, while data on some servers and local workstations had been compromised. It believed the affected information included names, addresses, birth dates, phone numbers and PhilHealth identification numbers.

That incident is not being linked to PHP2Shell.

It shows why a statement about one database cannot answer every question about people's records. Copies may be held elsewhere. After a breach, an agency should explain which systems were affected and what information they contained.

For someone who submitted an ID or a medical document, being told that the website is back online does not answer whether their information was exposed.

THE FIX HAS TO REACH THE SOFTWARE BEHIND THE WEBSITE

Updating a website's appearance will not solve a flaw in the software running it. The hosting team has to install the corrected PHP release or the equivalent security fix supplied by its software vendor.

The PHP team says temporary measures cannot make an affected installation fully safe. Its advice is to update.

The check also extends beyond the main website. Singapore's advisory tells organizations to inspect third-party applications and components, because those may use PHP even when the main site does not.

For Philippine agencies, that means asking contractors for evidence that the repair was completed. It also means checking for signs of earlier unauthorized access. Installing a fix does not establish what happened before it was installed.

AFFECTED PEOPLE NEED A NOTICE THEY CAN ACT ON

Under National Privacy Commission rules, mandatory notification generally applies when sensitive or identity-fraud-enabling data is believed to have been acquired without authorization, with a likely real risk of serious harm. When those conditions are met, the agency generally has 72 hours from knowledge or reasonable belief of the breach to notify the commission and affected people, subject to limited exceptions.

Outsourcing the service does not remove that responsibility.

For readers, check unexpected messages through an agency's established contact channels. Do not hand over passwords or one-time codes to someone claiming to be repairing your account.

PHLPost's September warning about fake parcel messages shows how scammers impersonate government services. A familiar agency name in a text message is not enough reason to trust its link or payment request.