Local
SEPTA disables online trip alerts while it addresses PHP security risk
SEPTA has taken its website-based real-time bus and train tools offline after federal cybersecurity officials urged organizations to patch vulnerable PHP software or disable affected services. Riders can still check arrivals through Google Maps, Transit and station monitors.
SEPTA disabled systemwide alerts and online real-time bus and train tracking Wednesday as the agency responds to federal cybersecurity guidance about vulnerabilities in PHP, a programming language used by nearly 70% of websites.
The National Security Agency said Wednesday that the flaws could make systems easier for hackers to exploit. Federal cybersecurity officials recommended that organizations using affected PHP software install security updates promptly or take vulnerable services offline until they can be secured. SEPTA has not said that its systems were breached.
Riders can continue to get real-time trip information through Google Maps, the Transit app and monitors at stations, SEPTA said. Transit, which normally charges for some features, agreed to temporarily lift its paywall to help SEPTA customers.
The security issue also affected SEPTA’s senior fare card registration site and employee intranet. The agency said it is working to restore the services and will provide updates as they become available.
Customers seeking assistance can call SEPTA at 215-580-7800 starting at 7 a.m. Thursday, Oct. 22. Cashiers and passenger services representatives are also available to help.
Cybersecurity expert Matt Barnett said the growing use of artificial intelligence to identify vulnerabilities is accelerating the pace at which organizations must respond. Keeping systems secure, he said, will require faster and different approaches to applying updates.