Webmasters, put the coffee down. Organizations that run on the PHP programming language are being told to install a critical update TODAY or think about taking their websites offline, the BBC reported.
The PHP security team gave advance notice on Tuesday of a security release fixing two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale, per PHP.net. The release was scheduled for Wednesday at 14:00 UTC (9am Central), and the team said it could ship earlier if details went public or attacks showed up in the wild.
The UK’s National Cyber Security Centre did not mince words: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” it said in an alert. Its counterparts in the EU and Australia issued similar warnings. CERT-EU said the risk scores “indicate the potential for unauthenticated remote code execution,” meaning attackers could potentially install malware and take sites down.
Some aren’t waiting around. The Netherlands’ cyber-security agency says it is taking its own website offline, and the BBC reports the sites of a Dutch public health agency and the lower house of parliament went dark too. Cloudflare CTO Dane Knecht said he was “seeing early attacks emerging.”
Why should YOU care? “PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels,” security firm Huntress said. CERT-EU said the flaws could affect every version back to PHP 5, which launched in 2004. Exact affected and fixed versions are due with the release, so check with your host. Yes, we’re looking at our own server too.
Featured image: editorial illustration by Bugle Blast.
Sources: BBC News; UK NCSC; PHP.net; also reported by The Verge
Leave a Reply