AICC has alerted members to a serious website security issue that requires immediate attention. The following information has been vetted by AICC’s Innovation and Technology Committee.
Hackers are already exploiting two critical security flaws in PHP, software that runs behind the scenes on millions of websites throughout North America, including those built with WordPress. On October 26, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that the flaws were being used in real attacks. The vulnerabilities allow attackers to take control of a website server without a password. The official CISA alert is available at cisa.gov.
According to AICC, hackers could steal business or customer information, change or delete website content, disrupt operations, or use the website server to reach other connected systems.
AICC advises members who have not already done so to contact their website provider, developer, or IT team to address the following questions:
Does the company’s website, online store, customer or vendor portals, or any equipment with a web admin page use PHP?
If so, have the October 21 PHP security updates been installed?
If a system cannot be updated immediately, what protections are in place in the meantime?
How quickly are critical updates installed, and who is monitoring for an attack in the meantime?
Have there been any signs of a break-in since October 21? Installing the update does not remove an attacker who is already in the system.
Websites that do not run PHP, such as sites built entirely in Python, are not affected by these flaws. Website providers can confirm which software is being used.
AICC also recommends that companies using a hosting provider request written confirmation that their website is running on a patched version. If anything appears wrong, members should contact their IT provider and cyber insurance carrier immediately.
Beyond the immediate threat, AICC recommends that members review their technology systems, from office and business systems to machine centers on the plant floor. Companies should determine which systems could continue running and which would stop if internet access were lost or if systems had to be disconnected during a cyberattack.
Understanding these vulnerabilities can help companies develop backup plans to keep essential business and production operations running.
AICC outlined two scenarios for members to consider: an internet outage, where the company’s internal systems remain healthy, but cloud-based services are inaccessible; and a cyberattack, where on-site systems could be affected. This makes clean backups and paper procedures important components of a response plan.
AICC encourages members to understand which systems and information would remain accessible without an internet connection and to establish procedures for maintaining operations during a disruption.
