Security flaw in PHP exposes hundreds of Icelandic websites

A serious security vulnerability in the PHP programming language left hundreds of Icelandic websites and systems exposed this week, including sites run by major public organisations in Reykjavík. The breach affected Strætó, the capital area’s bus company, the University of Iceland and the City of Reykjavík, RÚV reported Thursday.

Anton Már Egilsson, CEO of the cybersecurity company Syndis, said that “a very long list” of Icelandic sites was exposed. The incident highlights the widespread reach of the vulnerability, though the full list of affected organisations has not yet been made public.

CERT-IS, the cybersecurity team of the Post and Telecom Administration, issued a warning about the vulnerability on 21 October. The organisation found that hundreds of Icelandic web servers were at risk. According to Magni R. Sigurðsson, head of CERT-IS, there have been no reports so far of successful intrusions as a result of the flaw.

The vulnerability is not limited to Iceland. Similar vulnerabilities led to many websites being temporarily taken offline in several European countries, including the Netherlands, Finland, Germany, France and Belgium, according to Vísir. Security experts believe attacks began before the flaws could be patched in those countries, which increased the urgency of the response.

TopicsCERT-IScybersecurityPHPReykjavíkStrætóUniversity of Iceland