The Free Library’s online catalog was taken down for security. A new one is coming this week.
Library staff removed the catalog on Oct. 23 as a precaution after vulnerabilities were found in the open-source programming language PHP.
The Free Library of Philadelphia might not seem like a likely cyberattack target, but it is taking no chances.
The library shut down its online catalog last month because of digital security concerns. The library’s catalog remains down, but the Free Library plans to launch a new online catalog this week.
Library staff removed the catalog on Oct. 23 as a precaution after vulnerabilities were found in an open-source programming language, PHP, which is used on roughly 70% of websites across the world.
The PHP security issues, which have collectively been called “PHP2Shell”, were identified and announced by researchers using OpenAI’s GPT-5.6 Sol model, on Oct. 21. The issues in the coding language could have allowed hackers to take control of web servers and access critical data without authentication or prior access.
“Cyber actors are likely to weaponize PHP2Shell vulnerabilities. These risks are serious enough to require immediate patching across United States Government departments and agencies … We stand with our warfighters and our domestic and foreign partners to improve our collective cyber defenses and threat detection,” said the National Security Agency in a statement last month.
According to OpenAI, the issue was identified before hackers could exploit it, and a patch for the issue was immediately made available. However, in the days before the problem was announced, some attacks were attempted.
The Free Library did not see signs of any security breaches on its own servers, but decided to take down the catalog based upon vulnerabilities reported in other regions and the City of Philadelphia’s Office of Information and Technology standards, according to Free Library spokesperson Mark Graham.
SEPTA shut down its real-time tracking tool for a day, and other websites including Internet Archive, parts of Wikipedia, and governmental websites in Europe and Asia were also taken down in precaution.
It’s unclear why it has taken more than two weeks for the Free Library to launch its new catalog. Until then, patrons can still find e-books and audiobooks through the library’s app Libby or OverDrive, and the library has extended returns for borrowed materials through Thursday.
“We apologize for any inconvenience to patrons since we realize [the catalog] is a valuable resource and used by many. The security of our patrons, staff, and community is a high priority for the Free Library. So is high-quality customer service, which is why the down time is as short as possible, and library staff… can handle any questions about finding materials or holds in person or on the phone,” Graham said by email.
Borrowing in person at library branches has been unaffected.
