Two critical vulnerabilities in PHP could allow hackers to steal data, modify website content, and even take over servers. This programming language is used by millions of websites, including those built on WordPress, Drupal, and Joomla. The EU is advising against temporarily disconnecting resources from the internet that cannot be quickly secured.
Two critical vulnerabilities in PHP could allow hackers to steal data, modify website content, and even take over servers. This programming language is used by millions of websites, including those built on WordPress, Drupal, and Joomla. The EU is advising against temporarily disconnecting resources from the internet that cannot be quickly secured.
Reuters reports this.
Both vulnerabilities have a CVSS 4.0 severity score of 9.2 out of 10. According to the European Computer Emergency Response Team CERT-EU, they could allow attackers to remotely execute malicious code on a server, even without logging in.
PHP developers plan to release a patch today, October 21, at 17:00 Kyiv time. At that time, they promise to reveal technical details and name specific versions affected by the vulnerability. So far, CERT-EU suggests that all versions of PHP, starting with PHP 5, may be at risk. However, there is no official confirmation of this yet.
The Australian Cyber Security Centre (ACSC) has also urged organisations to check where they are using PHP and monitor for suspicious activity, but said it is not currently aware of any cases of these vulnerabilities being used in real-world attacks.
Previously, dev.ua wrote that the Russian-linked hacker group UAC-0099 is attacking Ukrainian civil servants, military personnel, and logistics companies using a new Trojan, ASHVEIN.
