Critical PHP vulnerabilities could take websites down as patch is due

Developers of PHP, a programming language widely used to build websites and web apps, say security fixes for two critical vulnerabilities are due today at 10AM ET (US Eastern Time). An advisory published on Tuesday rated the flaws 9.2 out of a possible 10. The patch could arrive earlier if the vulnerability details become public or there is evidence of active exploitation. Users are urged to upgrade as soon as the release is available.

What attackers could do

According to cybersecurity firm watchTowr, the flaws are Remote Code Execution vulnerabilities that reportedly affect every PHP version from PHP 5 onward. Attackers could run their own code on affected servers, alter websites, steal data and carry out other malicious actions.

Potential scale

One security researcher estimates that more than 1.3 million internet-connected hosts are likely affected. Wordfence, a provider of WordPress security plugins, warned that every WordPress site will be vulnerable because all of them run on servers using PHP. WordPress reported last year that it powers more than 40 percent of the internet. Wordfence also said the fix cannot be installed through automatic updates, so site owners must find out who is responsible for updating PHP and apply the patch manually.

Recommendations and early attacks

The European Union Computer Emergency Response Team and the UK National Cyber Security Centre have issued advisories. They encourage organisations that cannot patch immediately to isolate internet-facing apps from public networks or take them offline until the risks are fully mitigated. GrapheneOS, a mobile operating system developer, has temporarily taken its user discussion forum offline because proof-of-concept exploits are already being developed. PHP developer Gina Peter Banyard says patching is the only mitigation, and that otherwise turning servers off might be the most sensible thing to do.

Researchers at cybersecurity firm Sansec expect mass attacks within 15 minutes of the release. Cloudflare chief technology officer Dane Knecht says early attacks are already emerging against PHP sites on the platform, and the company is temporarily updating its firewall rules as a stopgap until the fix is available.