PHP releases emergency fixes for critical flaws as sites go offline to stay safe

[IronFist38]

PHP has rushed out emergency updates for two critical flaws, and some organisations have taken their websites offline rather than risk being hacked. The Register's Lindsay Clark reports that the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35

The two bugs let an attacker run code on a server without logging in. CERT-EU scored both at 9.2 out of 10. PHP says any installation serving web requests may be affected, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with mod_php, where a demonstrated exploit fires before any application code even runs

Attacks have already started. Jake Knott of watchTowr said attempts using php2shell user agents are being seen in the wild. BleepingComputer adds that details leaked before the planned disclosure, that the flaws reportedly go back as far as PHP 5, and that Cloudflare pushed out an emergency firewall rule

The reaction shows how seriously this is being taken. Finnish government sites, the Dutch parliament, Dutch cyber security and data protection authorities and privacy group noyb all took their websites offline as a precaution. Huntress points out that PHP sits underneath WordPress, Drupal, Joomla and Magento, which together power a huge share of the web

This is one of the most serious web security events of the year. PHP is everywhere, and plenty of servers run old versions that will never be updated. Anyone running PHP should patch immediately, and if that is not possible, consider taking sites offline until they can

Have you patched your PHP servers yet? And how many forgotten PHP sites do you think are still out there?

PHP devs publish critical bug fix as site owners warned: Pullwww.theregister.com

[RomoneyWalters]

This forum runs on PHP too. I hope our admins have updated already. SMF users everywhere should check their hosting