The discovery of two critical vulnerabilities in the PHP programming language has prompted a global response. PHP is used by approximately 70% of websites with identifiable server-side technology, including Wikipedia, Slack and WordPress-based websites. According to the BBC, more than 30 million websites could be affected.
The vulnerabilities, found in code more than a decade old, could, under certain conditions, allow hackers to execute malicious code on servers without requiring passwords, potentially gaining access to files and sensitive data.
The vulnerabilities could allow hackers to access servers and files and steal sensitive data.
The severity of the vulnerabilities has prompted government agencies in countries including the Netherlands, France and the UK to temporarily shut down websites and digital services as a precaution. The Wikimedia Foundation also temporarily suspended some of its systems.
The vulnerabilities were investigated in August using advanced AI tools, including by researchers from Calif and Wiz. They were publicly disclosed on 20 October, and the PHP development team released emergency security patches the following day.
Cybersecurity authorities in the US, UK and EU have urged administrators to update their systems immediately, warning of potential large-scale attacks.
Sources: BBC, Guardian
What is fyi.news?
