Compiled with the help of artificial intelligence, based on Spanish-language information. Source below the article.
Canary Islands administrations race to protect websites from major security flaw
Public administrations in the Canary Islands are working against the clock to prevent their websites from being hacked. After an artificial intelligence system flagged two security flaws on Wednesday in the PHP programming language – which underpins the basic architecture of 70% of the world’s websites – the State Digital Administration Agency, through the National Cyber Security Institute (Incibe), has asked all public administrations in Spain to take preventive measures to avoid a mass data leak. In the Canary Islands, this has led to restrictions and patching across a range of institutional, educational and university websites, with each island authority implementing its own measures to safeguard its information.
Critical services taken off external networks
The Canary Islands Government has adopted a series of protective measures. From the moment the vulnerability was flagged, the Directorate-General for Digital Transformation of Public Services disconnected critical services from external networks, keeping them operational only via the internal network. Information about the vulnerabilities and recommendations has also been published on the Technology portal for security contacts, detailing the measures to be followed. Priority has initially been given to protective measures, and an assessment of whether any damage has occurred will only be possible once normal service is restored.
University websites restricted as a precaution
The problem has also affected other institutions. Both the University of La Laguna (ULL) and the University of Las Palmas de Gran Canaria (ULPGC) have temporarily restricted external access to some of their websites as a preventive measure to block outside access. Both are updating and patching their websites so they can return to normal as soon as possible, and both insist they have not received any kind of attack.
What is the PHP2Shell vulnerability?
The situation follows Wednesday’s announcement by the research arm of cyber security firm Wiz that it had discovered “multiple critical vulnerabilities” in PHP, a popular programming language that supports millions of websites. The Israeli company says it used artificial intelligence models developed by OpenAI – the creator of ChatGPT – to identify the security gaps, which it has named PHP2Shell and describes as “the most serious vulnerabilities ever discovered”, in a technology that is redefining cyber attacks as well as the defence strategies of an increasingly critical sector.
According to the company, the problem arises on systems running an older version of the software – specifically, anything below patch 8.3. “The problem is that many old versions don’t even have patches,” explains Vicente Blanco, a computer engineer and vice-rector for Digital Transformation at the ULL. The Spanish Cyber Security Institute, Incibe, has offered to provide the patches or basic programming tools to remedy the situation.
Millions of devices exposed worldwide
Globally, according to the company Censys, more than 2.5 million devices are exposed to this vulnerability. In Spain, an estimated 1.5 million “.es” domain websites may be vulnerable. “This doesn’t mean they have been attacked, but it does mean they are highly exposed,” Blanco stresses. A vulnerability like this can allow hackers to access the system, giving them entry to databases or confidential information.
WordPress and Moodle among affected platforms
“At the ULL we had to act very quickly,” Blanco says. As he explains, PHP is the language behind websites such as WordPress (for content management) and Moodle (for virtual campuses), both widely used in the web architecture of the education sector. In the ULL’s case, which has more than 50 sites, the decision was taken to block external visits to some of them – including those hosting news and regulations – while the problem is resolved. “We have restricted them to internal use, so you can only access them with a university VPN,” he explains. Work was also carried out yesterday on the virtual campus, which remained closed for several hours. “We prioritised it and by the afternoon it was working again,” Blanco highlights. He suggests the problem is now 85% or 90% fixed. “We will resolve it over the course of Thursday and Friday,” he says.
Firewall updates and progressive reopening
The Canary Islands Government, for its part, has applied protective measures to its antivirus systems through virtual patching that prevents exploitation of the vulnerability, along with updates to protection licence packages on corporate firewalls. On the internal network, programmes that cannot yet be updated remain closed to external access. The restrictions will be lifted progressively as updates are carried out and sufficient security guarantees are in place.
What’s happening in the Canaries – straight to your phone
News, weather alerts and practical updates – direct from the islands, in English. We live here and know what’s going on – before the international media catch up. Everything lands on our WhatsApp channel – no middlemen, no algorithm. Curated for families, expats and travelers.
Supreme Court next stop for illegal Arguineguín homes
How to apply for public housing in the Canary Islands
Viral meningitis outbreak hits three children on El Hierro
Canary Islands tourism chief offers dialogue on residentialisation
Canary Islands office helps small councils ditch the peseta
Two tonnes of illegal tropical fruit seized at Tenerife port
Canary Islands approves new €1.6bn development fund
Mogán mayor says her €65,000 salary is too low
Abandoned cars in Canary Islands: hundreds left to rot
