"Very serious" online security issue not yet over

It is measured at 9.2 out of 10, on a scale used to assess vulnerabilities in computer systems. The flaw is particularly serious because of how widely the programming language is used. It is often estimated that 70% of websites rely on PHP.

"People had already started taking websites offline today [Wednesday] while waiting for the update, which was released at 2pm Icelandic time," Bjarki Þór said on Wednesday evening.

Bjarki says malicious actors could have gained extensive control over websites if they had managed to gain access to their systems. If an attacker had gained access by exploiting these vulnerabilities, they could have taken control of a website, altered information on it, attempted to deceive users and potentially gained deeper access to the systems of those who owned the websites.

"They could have changed content on the websites to try to deceive users," he says.

"Or they could have tried to penetrate further into the systems of those operating the websites and taken control of them." Bjarki urges all smaller businesses that do not manage their own websites to contact their website operators to check whether updates are needed.

The danger has not yet passed. The coming days and weeks will be spent monitoring which websites have been updated and which have not. Anton Már Egilsson, chief executive of cybersecurity company Syndis, said yesterday that a very long list of websites and systems was exposed to serious vulnerabilities in the PHP programming language.

The security flaw affected numerous Icelandic websites. For example, Reykjavík City's website was temporarily taken offline while an update was carried out. The same applied to the University of Iceland's websites, while disruptions were also reported on Strætó's website.

"The list is very long. You could say this affects a cross-section of Icelandic businesses and organisations that are using this technology in one way or another," Anton Már said. He added that hackers can quickly identify vulnerabilities by examining the patch.

This was a task that often used to take days or weeks, but now both are simply fed into an AI model, which is then exploited to break into systems. CERT-IS is a government body operating under Iceland's Ministry for Foreign Affairs. It is responsible for monitoring cyber threats, identifying security vulnerabilities, coordinating responses to cyberattacks and helping protect Iceland's critical digital infrastructure, and is also Iceland's national contact point for international cybersecurity cooperation.