Around 25 Madhya Pradesh government department websites taken offline over PHP security flaws

The websites of about 25 government departments in Madhya Pradesh have been kept shut for fear of hacking. Many departments had not updated schemes, notices and orders on their sites for years. Now even the websites of departments whose officials were regularly uploading details of their work have gone offline. Amid officials' long-standing practice of not updating the sites, updating the programming language is now being cited as a fresh excuse.

The reason is that two major security flaws have surfaced in PHP, the programming language that runs the websites. They have been named PHP2Shell. According to cyber security experts, hackers can exploit the flaws to run dangerous code on a server without permission. They can also steal data such as passwords and API keys. The bug is said to be about 10 years old, and work to update the software is under way.

Officials and employees of various departments say the PHP version used on their department's website server is being updated. According to them, there was a risk of a breach of government computer systems and a cyber attack through the PHP server, so the step was taken. The websites have been taken offline so that the security of government data is not compromised. Meanwhile, questions are being raised in Madhya Pradesh about the role of officials of the National Informatics Centre (NIC).

PHP is used to build and run websites. About 90 per cent of the state's government websites are built on PHP versions. This is why the impact of the matter is being seen on a large scale.

According to experts, choosing the right, latest PHP (PHP: Hypertext Preprocessor) version for a website and keeping it updated is essential for its security, speed and proper functioning. Old or outdated PHP versions stop receiving support from developers. This is called End-of-Life (EOL). Newer PHP versions fix older security threats (vulnerabilities) and bugs. Websites running on older versions face a higher risk of hacker attacks.