The U.S. National Security Agency (NSA) recently issued an urgent warning regarding two critical vulnerabilities discovered in PHP, the server-side programming language that is crucial for approximately 70% of websites on the internet, including popular content management systems like WordPress. These critical flaws, for which the PHP Foundation has already released fixes, allow attackers to penetrate a server's file system or the database used by a web application.
Remarkably, these vulnerabilities have existed in all PHP versions since version 5, released in 2004. The NSA warned that if a website cannot be immediately updated, it should be taken offline. For websites not using relatively current PHP versions, an update is essential, as PHP versions 8.1 and older are no longer supported. It is recommended to update the web server to the current stable PHP version.
So how did such fundamental and decades-old flaws, affecting nearly every website on the internet, come to light now? Advanced analytical tools and techniques contributed to their discovery. Groups of security researchers, utilizing sophisticated code analysis systems, independently identified these weaknesses as part of initiatives focused on finding bugs in open-source software.
The researchers followed responsible vulnerability disclosure principles, collaborating with the PHP Foundation to develop and test fixes before the information was publicly announced. A wide range of other technology and security entities were involved in the process to ensure the robustness and effectiveness of the patches.
These vulnerabilities were found by researchers before they were exploited by hackers, meaning no active attacks have been reported. This is partly because, before the advent of advanced code analysis tools, these flaws were difficult for attackers to exploit. However, with the availability of these tools, this barrier is lowered, potentially facilitating the adaptation of exploits for various PHP versions and configurations. In other words, this is a type of security issue that, while discovered and prevention enabled by these tools, simultaneously poses a high risk precisely because of their existence.
Planen Sie eine neue Website oder App?
Schreiben Sie mir, was Sie vorhaben — ich schaue es mir gerne an und berate Sie zum besten Vorgehen.
Now that the problem is publicly known, it is a race against time for the internet community to patch tens of millions of websites before hackers attempt to exploit unpatched ones. This is the origin of the NSA's recommendation that if a PHP website cannot be immediately updated, it is safer to temporarily take it offline.