SEPTA restores real-time tracking after taking tools offline for PHP security patch

SEPTA's real-time bus and train tracking tools were working again Thursday morning after the transit agency shut them down to install security updates tied to a newly disclosed flaw in PHP, a programming language used across much of the internet.

SEPTA spokesperson Joe Leonard told The Philadelphia Inquirer that the agency took the tracking system offline at 1 p.m. Wednesday and had it running again by 6 a.m. Thursday. NBC10 reported that systemwide alerts on SEPTA's website returned around 7 a.m. Thursday. 6abc described the outage as occurring Thursday.

The affected services included real-time travel information and alerts on the SEPTA app, the agency's social media accounts and septa.org, according to 6abc. The Inquirer reported that the tracking tool does not store sensitive information and was disabled as a precaution. SEPTA also told 6abc that its senior fare card registration site and employee intranet rely on PHP.

During the outage, riders could still find real-time bus and Metro information through Google Maps and the Transit app, 6abc reported. NBC10 said the Transit app, which normally requires a subscription, agreed to temporarily drop its paywall for SEPTA riders. Regional Rail information remained available on station monitors and through announcements, and SEPTA's customer service line opened at 7 a.m. Thursday to assist riders, according to 6abc.

The shutdown followed federal guidance urging organizations that use PHP to install updates immediately or take vulnerable services offline until secured, NBC10 and 6abc reported. PHP runs on roughly 70% of websites, according to the outlets.

Accounts of how the flaw came to light differed. The Inquirer reported that PHP's developers announced Wednesday that they had found a vulnerability that could let hackers remotely access websites, and that the Cybersecurity and Infrastructure Security Agency described the flaws as allowing attackers to plant malicious code. NBC10 attributed the discovery of the flaws to the National Security Agency. Both 6abc and the Inquirer noted that artificial intelligence was involved in finding the flaw.

The Inquirer reported that the warning set off a worldwide effort Wednesday in which government websites and other services went offline for updates. Leonard told the newspaper the agency was "part of a larger global story."

Cybersecurity expert Matt Barnett told NBC10 that AI-driven detection is making it harder to keep up with patches, saying "the scale and the speed at which these vulnerabilities are coming out is really not something we've seen before."

Compiled by True News from reporting by The Philadelphia Inquirer, 6abc Action News, Pennsylvania Capital-Star and NBC10 Philadelphia. Each outlet's original story is linked below.

Originally published by True News: https://truenews.bagleyenterprises.net/stories/347