A severe vulnerability has been found in PHP, a key web technology, forcing organizations to patch their websites quickly. The flaws are rated 9.2 on the CVSSv4.0 severity scale. PHP's developers say they will release a patch on Wednesday and urge users to "upgrade as soon as the release is available," according to Reuters.
The problem is serious enough that EU cybersecurity officials have warned companies that cannot apply the fixes to be prepared to take websites using PHP offline temporarily. The EU Computer Emergency Response Team (CERT-EU) describes the risk as unauthenticated remote code execution, meaning an attacker could insert code and run it on a vulnerable server. The Australian Cyber Security Centre (ACSC) has issued similar guidance, advising organizations to identify PHP servers, apply patches and monitor for malicious activity. The ACSC was not aware of any active exploitation, but Cloudflare CTO Dane Knecht said attacks were emerging. Cloudflare has updated its firewall rules as a temporary measure.
PHP, short for PHP: Hypertext Preprocessor or Personal Home Page, is a scripting language used in website development and has been around for decades. Platforms including Drupal, Joomla, Magento and WordPress rely heavily on it, so PHP runs many of the systems that power the web.
The risk is compounded by AI, which can be used to find vulnerabilities that hackers can exploit. End users have little they can do beyond patching personal PHP web servers, since browsers and applications need no patches. Web users can only hope the patches work and that downtime is brief.
Source: AppleInsider · Summarized by HeadlinesBriefing