Hong Kong’s Digital Policy Office has urged government departments, bureaus and other public organisations to perform immediate security reviews after vulnerabilities were found in the PHP web programming language.

The PHP programming language. Photo: negativespace.co, via HKFP remix.

It urged potentially affected bodies to conduct reviews “to check whether their information systems had been affected and complete all patching work as soon as possible; otherwise, the relevant systems should be temporarily taken offline or isolated to reduce the risk of malicious intrusion,” according to a Thursday press release.

As of Friday, no cyber security incidents had yet been reported. The Digital Policy Office said it had already completed the required fixes for the hosting service that hosts government websites.

The security flaws were discovered by AI, with a fix issued on Wednesday afternoon. According to the BBC, cyber security firm Wiz said they were the “most severe vulnerabilities ever discovered” by the technology, while OpenAI said the discovery was “one of the most impactful security issues in recent memory.”

The flaws could provide a direct path to a server’s database or file system, allowing attackers to bypass security checks.

The Digital Policy Office. Photo: Screenshot, via YouTube.

Mart van de Ven, a technologist at HYPE.hk, told HKFP on Friday that the government’s approach was correct: “It’s a game of cat and mouse – and sadly as site owners, we are the mouse. Even if you are fast enough, there’s always a chance of catching a stray swipe of the paw; and if you are too slow, you’re all but guaranteed to be lunch. The bulletin covered the right course of action, but 48 hours in a world of AI cats makes for a tasty mouse.”

Patch the Planet

Under an OpenAI programme called Patch the Planet, cybersecurity researchers at Wiz and Calif linked up with the PHP Foundation to allow advanced AI tools to dig out and fix issues in the web development language. The PHP flaws had been undetected for over a decade, but were uncovered in a matter of weeks.

Wiz said in a blog post that around 70 per cent of the internet may be affected.

The fix was rushed out on Wednesday after news of the vulnerabilities leaked on social media the day before.

OpenAI, the creator of ChatGPT. Photo: Levart_Photographer/Unsplash.

PHP can run underneath websites, hosting platforms, content management tools, and other third-party products. It quietly powers platforms such as WordPress, Drupal, and Joomla.

Those rolling out the software patch would need to ensure they are running the latest version of PHP, a task which some organisations may find complicated.

In a post on X on Wednesday, Chief Technology Officer Dane Knecht from internet infrastructure firm Cloudflare said: “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”