A security vulnerability has made headlines, causing several websites – including some in Luxembourg – to go offline temporarily. A technical issue in the popular programming language PHP was to blame, disrupting access to many sites, including those run by banks. This has left many people wondering whether their personal data is now at risk.
PHP is an efficient programming language that has been reliably powering websites for years. It is used by between 70% and 80% of all websites worldwide, with around 6,000 servers running PHP in Luxembourg alone. According to Pascal Steichen, CEO of the Luxembourg House of Cybersecurity, security flaws like the one seen on Wednesday can sometimes put data at risk of falling into the wrong hands.
"A criminal could take control of a compromised website and use it, for instance, to launch further attacks or attempt to infiltrate a company in order to steal data", Steichen explained. "It is important to note that this vulnerability affects server-side programmes, not applications on your phone or computer."
"The issue only concerns the public-facing website, not the backend systems like Luxtrust or the bank's own systems and apps that process transactions. The vulnerability does not affect systems running the transactions themselves, just their websites."
Many online shopping platforms allow users to store their credit card details for convenience. In theory, attackers could access this information if a site is compromised, but that does not necessarily mean they can steal money directly.
"If a website using PHP is compromised, a criminal could potentially read that information", Steichen said. "However, that alone does not allow them to carry out a transaction or immediately steal money. It is comparable to someone stealing your card from your wallet – there are still many other steps required before any money is lost."
Such security issues are not uncommon and are regularly reported to organisations like the Luxembourg House of Cybersecurity. These bodies then develop updates to address the problems. What set this incident apart was the fact that details of the vulnerability were leaked to the public.
"Someone who was aware of the flaw shared the information, making it public and putting enormous pressure on the PHP team to issue an update quickly. Once that update is released, it is essentially business as usual", Steichen added.
There is no cause for panic, Steichen assured. So far, there have been no major cyberattacks linked to this incident, but authorities continue to monitor the situation closely.
Pascal Steichen will also be a guest on RTL Télé's evening news programme to provide further explanations.
