Serious security vulnerability in IT systems – the University has taken action

On Wednesday 21 October, it became known that two critical vulnerabilities had been discovered in a programming language used for websites and web-based services worldwide. The programming language, PHP, is used by many public authorities, among others.

Therese Strandberg, Head of office at ICT Services and System Development (ITS).

ImageMattias Pettersson

Sweden’s National Cyber Security Centre (NCSC) has urged all Swedish organisations to identify how PHP is used on their websites, install security updates and examine their systems for signs of intrusion or suspicious activity.

If the vulnerabilities are not addressed, in the worst-case scenario attackers could gain access to systems and carry out malicious activities.

Umeå University acted quickly and has taken all necessary measures in the systems that use PHP.

“At present, we are confident that we have done everything we can and consider our systems safe to use,” says Therese Strandberg, Head of office at ICT Services and System Development (ITS).

Temporarily closed websites

On Wednesday, the affected websites and digital services were taken offline while awaiting security updates. Many of the websites and services that were unavailable yesterday are now back online. Neither Umeå University’s external website nor its intranet has been affected. 

“For users, this may of course cause some disruption, but security comes first and we are working as quickly as we can to make everything available again. We will, of course, continue to monitor developments closely and remain alert to whether any further measures need to be taken,” says Therese Strandberg.

Employees and students do not need to take any specific action as a result of the current security vulnerability.

As always, however, it is important to remain vigilant and report anything that may indicate an IT security incident. 

Learn more at the webpage IT security incidents.