Charities have been urged to contact their web hosts to ensure their sites are secure amid the PHP cyber-security vulnerability issue.
The PHP Hypertext Preprocessor is an open source programming language designed primarily for web development.
This week, the PHP Group published a security update addressing two “critical vulnerabilities” within PHP that could leave organisations at risk of malicious codes infiltrating their networks.
The developer introduced patch fixes for the vulnerabilities and encouraged all PHP users to update their websites immediately.
The advisory firm Huro Data Technologies said today it used the external security platform MyDomainRisk to analyse almost 400 UK charity websites for use of the PHP Hypertext Preprocessor.
Huro Data Technologies analysed the websites of UK 380 charities with an annual income of more than £500,000, as well as those that were “best-known”, based on search engine results.
The firm found 40 per cent of charities had no visible PHP use on their websites.
Hugh Cox, chief information officer at Huro Data Technologies, said this did not necessarily mean these charities are safe from attacks.
“Our scan looks at a website from the outside, the way any visitor or attacker would,” Cox said.
“A well-run site may hide the PHP version or use PHP without showing any sign of it, so we simply can’t see it.
“PHP might also be running somewhere we don’t scan, such as a donations portal, a booking system, a staff login or another subdomain.”
Cox said many charities used outside suppliers to design their websites and the organisations themselves may not know the underlying details.
“That’s why we report a clean result as ‘we did not find any PHP visible’ instead of ‘safe’,” Cox said.
“The only way to know for sure is to ask whoever hosts or builds the site which PHP version they run.”
Nearly half of the charities analysed (48 per cent) had PHP visible on their website’s cookies or page markers but the PHP version was hidden, the research found.
Huro said hiding the PHP version was “good practice” but also limited the firm’s analysis.
“Many websites announce exactly which PHP version they run, usually in a header the server sends with each page,” Cox said.
“That doesn’t cause a flaw by itself, but it gives attackers a free shortcut.
He said when security flaws were announced, attackers run automated scans across the internet looking for sites that advertise an affected version and go after those first.
“Hiding the version takes a site off that easy list. It’s basic good hygiene, and the National Cyber Security Centre and most hardening guides recommend it.”