Charities have been encouraged to take steps to ensure their cybersecurity after vulnerabilities were found in widely used web language PHP.
Last Wednesday, two cyber-security companies with the help of artificial intelligence unearthed the “critical” flaws, which had gone undetected for at least a decade.
PHP Group, whose code is used by a vast number of online platforms worldwide, published a security update to address the issue and urged all users to update to its latest versions containing fixes.
The National Cyber Security Centre (NCSC) recommended that all organisations identify systems running PHP across their infrastructure.
Charity Digital has published its own guidance urging all UK sector organisations to follow the PHP and NCSC advice, warning that the PHP vulnerabilities “could be compromising the security that many charities have worked so hard to maintain”.
“Website security is paramount for charities to safeguard private stakeholder data and underpin the trust required to operate and deliver their mission,” it says.
Meanwhile, the Association of Charitable Foundations (ACF) has taken down its knowledge-sharing platform Funder Network while its developers carry out security checks and any necessary updates.
“We are working to restore access as soon as it is safe to do so and will share an update when it is available again,” it said in an update.
“The main ACF website and Funders Collaborative Hub use different technology, and neither has been identified as being affected by these vulnerabilities. Both remain fully available and can be used as normal.”
Charities ‘less cyber prepared’ than businesses
Separately, research published today by the Chartered Governance Institute (CGI) UK & Ireland has concluded that charity boards are “far behind companies” on cyber preparedness.
It surveyed 319 governance professionals, 19% of which worked with charities and not-for-profit organisations.
More than four in 10 respondents from charities said their organisation’s preparedness to respond to a cyberattack at board or governance level was “limited or non-existent” compared to 3% of listed and private companies.
CGI chief executive Linda Ford said: “As cyber threats continue to grow in scale and sophistication, policymakers, funders and regulators should consider whether charities have sufficient practical support to turn guidance into effective protections.”
