Fixes are out for serious flaws in software behind dozens of Alaska websites

Two newly disclosed flaws in PHP, software that runs behind many websites, can let an attacker take over a web server without a password. PHP's developers released fixes Wednesday and urged all users to update immediately.

The National Security Agency warned the same day that attackers are likely to weaponize the flaws, known as PHP2Shell.

A non-intrusive check by Alaska News found PHP-linked signals on at least 50 of 181 public-facing homepages sampled across state and local government, school districts, utilities, banks and credit unions. The check can't show whether any of those sites has installed the fixes, is exposed to the flaws or has been compromised.

The security firm watchTowr said decoy systems it runs to attract attackers recorded exploitation of both flaws Wednesday. Another firm, Huntress, said that afternoon it hadn't seen exploitation on the systems it monitors.

PHP's developers say "only an update is a complete solution." The NSA advised organizations to find internet-facing services that rely on affected versions and prioritize patches, and said systems that can't be updated promptly may need to be taken offline until the flaws are mitigated.

In Alaska News' sample, utilities had the largest share of PHP-linked homepages, 13 of 27, followed by cities and boroughs, 17 of 44. Shares were lower among state agencies, school districts, banks and credit unions.

The check loaded each homepage the way a browser does and looked for public signs of PHP, such as markers left by WordPress. It didn't test the flaws or try to enter any system. Of the remaining sites, 65 used other platforms, 36 couldn't be identified and 30 didn't respond to the automated check.

A site can show signs of PHP after its host has already installed the update, and other sites may use PHP without showing it. The results show what technology appeared, not which organizations remain at risk.

The state Office of Information Technology did not respond by Friday's deadline to emailed questions, including whether state agencies were told to check for or update affected PHP systems.

The Alaska Power Association, which represents Alaska electric utilities, referred questions to Homer Electric Association John Jungling, Homer Electric's chief technology officer, said in an email that a third-party company hosts the cooperative's website and is responsible for its security, and that Homer Electric uses outside tools to test the site and confirm vulnerabilities are fixed promptly.

The website isn't hosted on the utility's corporate network or on the control network, known as SCADA, that runs power generation and distribution, Jungling said. He described that network as "highly protected."

Asked whether Homer Electric had seen attempts to exploit the two flaws, Jungling said its primary protection systems see hundreds of different types of attacks on a regular basis, "including these types of attacks." He called the flaws "just the latest PHP security issues of many" and said a proper patch and update system normally corrects them.

Alaska News found no public report as of Friday afternoon of an Alaska website, agency or company compromised through the two flaws. That means no report was found, not that no incident occurred.