A patch is about to roll out, but the exploit affects more than 40 percent of the internet.
A patch is about to roll out, but the exploit affects more than 40 percent of the internet.
Security patches for the PHP programming language, widely used to build websites and web apps, have rolled out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked. In an advisory published on Tuesday , PHP developers said the vulnerabilities have a severity rating of 9.2 out of a possible 10, with some cybersecurity agencies encouraging websites to temporarily take their systems offline if they’re unable to apply the fix immediately.
The security patch was released today at 10AM ET, and PHP users are being urged to “upgrade as soon as the release is available.” According to cybersecurity firm watchTowr , the vulnerabilities are Remote Code Execution exploits that reportedly impact every PHP version from PHP 5 onward, and could enable attackers to run their own code on affected servers, allowing them to maliciously alter websites, steal data, and more.
The impact of these vulnerabilities could be vast, with one security researcher estimating that more than 1.3 million internet-connected hosts are likely affected. WordPress security plugin provider Wordfence also warned that every WordPress site will be vulnerable because they all run on servers that use PHP, which is no small number given WordPress reported last year that it powers more than 40 percent of the internet . Wordfence also warned that the fix can’t be installed using automatic updates, so site owners need to find out who is responsible for updating PHP to apply the patch manually.
The European Union Computer Emergency Response Team and the UK National Cyber Security Centre have both issued advisories that encourage any companies who can’t immediately patch their platforms to instead isolate their internet-facing apps from public networks or take them offline entirely until the vulnerabilities can be fully mitigated. Mobile operating system developer GrapheneOS says they’ve temporarily taken their user discussion forum offline because proof of concept exploits are already being developed and they “don’t want to take the risk.” According to PHP developer Gina Peter Banyard, patching is the only mitigation, and otherwise turning servers off “might be the most sensible thing to do.”
Multiple cybersecurity organizations have also prompted PHP admins to prepare, with threat researchers at Sansec saying they expect to see “mass attacks within 15 minutes of the release.” That doesn’t mean attackers are waiting around, however. Cloudflare chief technology officer Dane Knecht says “we are seeing early attacks emerging” against the platform’s PHP sites, and that Cloudflare is temporarily updating its firewall rules as a stopgap until the fix is available.
Update, October 21st: Updated language to reflect that the security patches have now been released.
This is the title for the native ad
This is the title for the native ad
