The Digital Policy Office today urged all sectors to take immediate action and apply patches after critical security vulnerabilities were found in PHP, a web programming language widely used in backend operations of global websites.

The office highlighted that it attached great importance to the incident. It had issued a security alert to all government bureaus and departments (B/Ds) and public organisations, requesting them to conduct a comprehensive review immediately to check whether their information systems had been affected and complete all patching work as soon as possible.

Otherwise, the relevant systems should be temporarily taken offline or isolated to reduce the risk of malicious intrusion, the office added.

The office also pointed out that it has completed the required patching for the web content hosting service that hosts the homepages of all B/Ds. As of now, it has not received any reports of related cybersecurity incidents.

The Hong Kong Computer Emergency Response Team Coordination Centre issued a security bulletin and a media message to the public today. The public and organisations can obtain assistance from the centre by email, telephone at 8105 6060, or via an online form.