The digital tools that allow SEPTA riders to track buses and trains in real time went offline in response to federal cybersecurity recommendations, officials said.
The systemwide alerts on SEPTA’s website were disabled Wednesday after federal cybersecurity officials recommended that organizations using PHP, a programming language, immediately install security updates or take affected services offline until they could be secured.
Riders can still access real-time information through the free Google Maps app and the subscription-based Transit app, which officials said has agreed to temporarily remove its paywall to help SEPTA riders.
On Wednesday, the National Security Agency said it found security flaws that created an environment easy to exploit and could allow hackers to gain access to systems.
The PHP code is used on nearly 70% of websites, including SEPTA and its real-time tools for tracking trains and buses.
“With the advent of AI doing a lot of the detection of vulnerabilities, it’s going to get harder and harder for us to stay on top of these things like we used to be able to. We’re almost going to have to change the way that we address these patches and provide timely updates because the scale and the speed at which these vulnerabilities are coming out is really not something we’ve seen before,” Matt Barnett, a cybersecurity expert, said.
SEPTA’s senior fare card registration site and employee intranet were also affected by the security threat. The transit agency said it is working to restore all services.
Riders can call customer service at 215-580-7800 for assistance starting at 7 a.m. on Thursday, Oct. 22. Cashiers and passenger services representatives will also be available to help customers.
Officials said they would share updates as soon as they are available.
