Late Wednesday afternoon, the Danish Agency for Societal Security issued a warning about two serious vulnerabilities in PHP, the technology behind many websites and online shops.
The flaws could allow unauthorised access and cause damage, and the warning has created a busy period for Safe IT Solutions in Vordingborg. Several customers have had to do without their websites after the IT company decided to take them temporarily offline.
- We reviewed the websites, assessed the risk and, as a precaution, chose to temporarily shut down the websites we considered high-risk, says Matias Aabye, CEO of Safe IT Solutions.
The IT company has not immediately identified any customers who have been hit by an attack. The websites were taken offline to protect them while hosting partner Curanet worked on the security updates.
According to Matias Aabye, warnings such as the one issued yesterday by the Danish Agency for Societal Security can often cause confusion. Business owners frequently do not know what technology their website is built on or who is responsible for keeping it updated.
That creates a risk that nobody ends up taking responsibility.
- We also find that companies may expect their website provider or hosting company to automatically take care of everything. But several suppliers can be involved, and responsibility for maintenance is not always clearly agreed. That means the task can fall through the cracks.
Matias Aabye does not believe business owners need to understand PHP themselves. But as a first step, he recommends contacting the provider that runs the website and getting confirmation of whether it is affected and whether the vulnerabilities have been fixed.
