PHP developers issue updates fixing vulnerabilities that saw websites go offline
Sign up now: Get ST's newsletters delivered to your inbox
Critical vulnerabilities in the PHP programming language saw government websites in Europe and elsewhere go offline on Oct 21. The PHP Foundation said the first signs of a flaw had been identified in 2024.
PHOTO: REUTERS
- PHP developers released four patches for two critical flaws and urged users to update at once. The bugs could let hackers run code on vulnerable systems.
- PHP Foundation said a researcher found early signs of one flaw in 2024, but it was not fixed sooner. The group called the delay a “structural failure”.
- NSA and CISA warned organisations to patch now or take systems offline. CISA said the flaws had not been exploited yet, but they still pose a risk.
AI generated
BRUSSELS – Developers of the PHP programming language said a set of new updates fixing two previously identified critical vulnerabilities was now live, and acknowledged a delay in addressing a previously identified flaw.
Government websites in Europe and elsewhere went offline on Oct 21 after the disclosure of critical vulnerabilities in PHP sent website operators around the world scrambling to protect their systems.
PHP underpins large parts of the internet and the vulnerabilities had raised concerns that a significant number of websites could be vulnerable to attack. The developers issued four patches to address two “critical” vulnerabilities that could allow hackers to execute code on vulnerable systems.
It said users were strongly encouraged to update immediately.
The PHP Foundation, which oversees development and maintenance of the software, said in a blog post that a security researcher in 2024 found the first signs of a flaw that led to one of the vulnerabilities, and that the issue was “theorised, but no concrete vectors were found, and other concrete issues with clear impact overshadowed these concerns”.
The delay in addressing the flaw “was a structural failure”, the foundation said.
The programming language’s developers had earlier said they had identified two critical vulnerabilities and urged users to update their sites as soon as a fix was released. Security experts warned that hackers would quickly reverse engineer the patches and race to exploit unpatched systems.
The US National Security Agency said in a statement that the vulnerabilities “often provide a direct path to the server’s file system or database”, and that if an immediate update was not feasible, organisations should take systems offline for full mitigation.
The Cybersecurity and Infrastructure Security Agency (CISA) said in an advisory that organisations “should immediately update” their PHP installations.
“While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organisations if left unpatched,” the agency said. REUTERS