The warning to travel firms

The Advantage Travel Partnership has told members to watch for unusual website activity and to confirm with hosting providers and developers that PHP fixes have been applied, rather than assuming a website update alone is enough.

What the flaws could allow

Two flaws in PHP, software said to underpin about 70 per cent of websites, were found by US researchers using AI tools. They could let an attacker run commands on a server without logging in. More than 30 UK government websites were taken offline after the alert.

The official advice

The UK National Cyber Security Centre advised organisations on any PHP version to move to the latest fixed version or consider taking the system offline. Fixed releases named are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while PHP 8.1 and earlier are no longer supported. ABTA said abta.com is not affected and it had no reports of members affected.

Sources: Travel Weekly | Hindsight Media (PHP/NCSC background)