Urgent PHP Security Update Addresses Critical Vulnerabilities
Translated & summarized from 0404 by baba
An emergency update for two critical PHP vulnerabilities, rated 9.2 out of 10, is being released today, potentially allowing remote code execution on servers. CERT-EU advises disconnecting vulnerable systems if immediate updates are not possible. The vulnerabilities may affect all PHP versions since PHP 5, impacting a large portion of global websites, including WordPress sites.
The story in 5 lines · by baba
- PHP is releasing an emergency update today for two critical vulnerabilities rated 9.2/10.
- The vulnerabilities could allow attackers to execute remote code on servers without authentication.
- CERT-EU recommends disconnecting vulnerable PHP systems from the internet if immediate updates are impossible.
- The flaws may affect all PHP versions since PHP 5, impacting many global websites.
- Older websites on unsupported PHP versions are at significant risk and may not receive the patch.
Website administrators and information security professionals worldwide are on alert as the PHP security team prepares to release an emergency update for two critical vulnerabilities in the widely used programming language. The flaws, rated 9.2 out of 10 in severity, could allow attackers to execute remote code on servers without authentication. The PHP security team urged all users to prepare for the update, which was scheduled for release at 2 PM GMT (5 PM Israel time) on Wednesday. They reserve the right to release the fix earlier if details of the vulnerabilities become public or if exploitation is detected.
CERT-EU, the cybersecurity body for European Union institutions, issued an official warning, advising organizations to identify all PHP-based systems and prepare for immediate updates. For organizations unable to update immediately, the warning suggests disconnecting internet-facing websites and applications from public networks until the patch is installed. While official technical details have not yet been released, the vulnerabilities may affect all PHP versions since PHP 5, released over 20 years ago. Full details, affected versions, and corrected versions will be published with the update.
The update was originally planned for Thursday but was moved up due to information about the vulnerabilities circulating online. Cybersecurity firm watchTowr has confirmed the vulnerabilities' existence, and security researchers have reportedly replicated them. Hosting and cloud companies are preparing to update PHP versions on their servers as soon as the fix is available.
These vulnerabilities could have widespread implications, as PHP powers a significant portion of global websites, including those built on popular content management systems like WordPress. Experts warn that older websites running on unsupported PHP versions, which will not receive the security patch, pose a particular risk. Website owners using hosting services are advised to confirm with their providers that servers will be updated, while those managing their own servers should be ready to install the new PHP version and plan for migration to a current version if their site runs on an outdated, unsupported one.