Government websites go dark as critical coding flaws send shudder across internet
Sign up now: Get ST's newsletters delivered to your inbox
Flaws in the PHP programming language may allow attackers to execute code on affected servers, cybersecurity officials say.
PHOTO: REUTERS
- PHP will patch two critical flaws rated 9.2, and EU cyber officials say sites should be taken offline if they cannot be fixed quickly.
- CERT-EU warned the bugs could allow unauthenticated remote code execution, while the ACSC told organisations to find PHP systems and prepare patches.
- Cloudflare said early attacks are already emerging, with GoDaddy warning of possible data theft or full system compromise.
AI generated
BRUSSELS – Government websites in Europe and elsewhere went offline on Oct 21 after the disclosure of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems.
Developers of the PHP programming language said on Oct 20 they have identified two critical vulnerabilities and urged users to update their sites as soon as a fix is released.
With reports that hackers were already exploiting the flaws to break into websites, government agencies in the Netherlands and Finland were among those that took sites offline as a precaution.
PHP is used across large parts of the internet, and speculation has circulated over the past day that websites running the software could be exposed to serious cyber intrusions.
“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” cybersecurity company Huntress said in a blog post.
In a security update, PHP said both vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale and urged users to “upgrade as soon as the release is available”.
It said a patch for both vulnerabilities was scheduled for 2pm GMT (10pm, Singapore time) on Oct 21.
Dane Knecht, chief technology officer of web and cloud security firm Cloudflare, said attacks were emerging, and Cloudflare was updating its firewall rules as a stopgap measure.
“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update,” he said on X.
The European Union Computer Emergency Response Team (CERT-EU) said on Oct 20 in an advisory that the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that can allow attackers to run malicious code on vulnerable systems without logging in.
CERT-EU urged organisations to prepare for the immediate patching of affected assets. It said those unable to do so should consider taking affected sites offline.
The Australian Cyber Security Centre (ACSC) issued similar guidance, urging organisations to identify PHP systems in their environments, prepare to apply patches and monitor applications for signs of malicious activity.
“ACSC is currently not aware of active exploitation related to these vulnerabilities,” the agency said.
Web hosting provider GoDaddy said the flaws could allow attackers to execute code on affected servers over the internet, potentially leading to data theft, website defacement or full system compromise.
Wordfence, a security plugin that protects WordPress websites, said all WordPress sites run on a PHP-installed server. It warned that automatic updates would not apply the fix and advised site owners to find out who is responsible for updating PHP on their sites.
PHP’s security team said details of the vulnerabilities, affected versions and the fixed releases would be published when patches are issued.
CERT-EU and the ACSC said all PHP versions from PHP 5 onward could be affected, although PHP has not disclosed which versions are vulnerable. REUTERS