Critical PHP Vulnerabilities Force Website Operators to Rush Security Fixes

The developers of PHP, one of the most widely used web technologies in the world, released fixes for two critical vulnerabilities on 21 October. On Wednesday this prompted website operators to hurriedly install security updates, while some organisations took their sites offline temporarily. The flaws could let an attacker execute code remotely on a server, which makes them a wide-ranging cybersecurity risk.

What is known about the vulnerabilities

The flaws have a severity rating of 9.2 out of 10. They affect PHP versions starting from version 5. PHP is used very widely, including in content management systems such as WordPress, Drupal, Joomla and Magento.

Impact in Latvia

In response to the risk, on Wednesday evening Latvian Public Media (LSM) temporarily suspended its LSM.lv portal and the websites and mobile apps of Latvijas Radio. The public broadcaster explained that this was a precaution while a possible cybersecurity threat was being dealt with.

The expert's assessment

Kirils Solovjovs, a cybersecurity expert, head of Possible Security and lecturer at the Baltic Computer Academy, explained the seriousness of the situation in an interview with Delfi. He compares it with the 2014 Heartbleed vulnerability, which affected a considerable share of websites at the time and allowed information held in a server's memory to be obtained remotely.

In Solovjovs's assessment, the potential impact this time could be even wider. He says roughly 70 percent of all pages on the internet are exposed to this attack. In his words, the main risk is the ability to execute code remotely on a server.