Security patches for the PHP programming language are expected to be released today at 10AM ET, addressing two critical vulnerabilities that developers rate 9.2 out of a possible 10 for severity. PHP is widely used to build websites and web apps, and the flaws could cause serious disruption across the internet if they remain unfixed. PHP developers said they may ship the patch earlier than scheduled if the vulnerability details become public or if there is evidence the exploits are being used. Users are being urged to upgrade as soon as the release is available.
According to cybersecurity firm watchTowr, the vulnerabilities are Remote Code Execution exploits that reportedly affect every PHP version from PHP 5 onward. Such flaws could let attackers run their own code on affected servers, enabling them to maliciously alter websites, steal data and more. One security researcher estimated that more than 1.3 million internet-connected hosts are likely affected.
Wordfence, which provides a security plugin for WordPress, warned that every WordPress site will be vulnerable because they all run on servers that use PHP. WordPress reported last year that it powers more than 40 percent of the internet. Wordfence also warned that the fix cannot be installed through automatic updates, so site owners need to determine who is responsible for updating PHP and apply the patch manually.
The European Union Computer Emergency Response Team and the UK National Cyber Security Centre have both issued advisories encouraging companies that cannot immediately patch their platforms to isolate their internet-facing apps from public networks or take them offline entirely until the vulnerabilities can be fully mitigated. GrapheneOS, the mobile operating system developer, said it has temporarily taken its user discussion forum offline because proof of concept exploits are already being developed and it did not want to take the risk. PHP developer Gina Peter Banyard said patching is the only mitigation and that otherwise turning servers off might be the most sensible option.
Cybersecurity organizations have also told PHP administrators to prepare. Threat researchers at Sansec said they expect mass attacks within 15 minutes of the release. Cloudflare chief technology officer Dane Knecht said early attacks are already being seen against the platform's PHP sites, and Cloudflare is temporarily updating its firewall rules as a stopgap until the fix is available.
More cybersecurity news from TechManNews.
