Guidance on recent security vulnerabilities to online services

You may be aware from the news of a series of significant security vulnerabilities in the software used to run some websites. This vulnerability was discovered by the use of AI and specialist knowledge by security researchers; there are updates that website owners can apply to mitigate the issues. However, while those updates are applied some websites might be vulnerable to attack and some websites might be offline.

We are working hard to protect our websites and the majority have already been patched or are not affected. But we’re aware you may have concerns about using the web and visiting online banks or online retailers.

It’s important to say that while there are risks at the moment, the majority of websites are being updated. Please be advised that this is an issue only affects the companies running websites, it’s not a vulnerability that affects your personal mobile, or computer.

However, please be extra vigilant during this time and be mindful of an increase in spam calls or other suspicious activity. We provide information on spotting spam emails here:

How to spot phishing emails? What to do if I recieve a phising email? – Digital Services

You can find information about keeping your accounts secure here; Accounts, Passwords & Security – Digital Services

Some sensible precautions you can take over the next few days include

• At work you can use Report the email in Outlook and that helps us identify spam.
• At home use the official mobile app for your bank and other important services where possible. Otherwise, type a website address you already know or use a trusted bookmark rather than following a link in an email, text message or social-media post.
• Do not provide a password, banking PIN or one-time security code in response to an unsolicited email, text message or telephone call.
• Be mindful of multifactor authentication notifications coming through from your bank
• Keep your personal computer, phone, tablet, web browser, applications and home router updated. Where possible, enable automatic updates.
• Use a different password for each important account, particularly your personal email and banking accounts, and enable two-step verification or a passkey where available.
• Check bank and online-account activity for transactions, logins, messages or security-setting changes that you do not recognise.
• Be mindful of emails that look like they are taking you to your bank but actually go to a subtlety different website. Use Google to find the real website.

If you believe you may have entered information into a suspicious or compromised website:

• Change Your password: go to the genuine service and change it promptly to a new unique password.
• If you receive a suspicious email or text: think carefully about whether it is real and avoid using links in the email. Suspicious emails can be forwarded to report@phishing.gov.uk, and suspicious text messages can be forwarded to 7726.
• Financial transactions: contact your bank immediately and report any suspicious transactions.

The immediate responsibility for addressing the PHP vulnerability lies with the organisations that operate websites. The purpose of this message is to provide clarity on what is happening.

Digital Services is continuing to monitor the issue and review the University’s systems and suppliers. We will provide further information if any specific action is required in relation to University services.

---