đš URGENT SECURITY ALERT: PHP2Shell
The NSA has issued an immediate warning to organizations using PHP after two critical vulnerabilities were discovered in the widely used programming language.
These flaws are rated CVSS 9.2/10 (Critical) and can allow unauthenticated remote code execution meaning an attacker may be able to execute malicious commands on a vulnerable server without having to log in first. (PHP)
Why is this serious? đ
đŽ PHP runs on a huge portion of the web and is commonly used for websites, web applications and server-side systems.
đŽ The vulnerabilities, collectively referred to as PHP2Shell, can potentially give attackers access to systems behind vulnerable PHP web services.
đŽ The risk is particularly serious for internet-facing servers, where attackers may be able to exploit the vulnerability remotely.
đŽ The NSA is advising organizations to identify vulnerable PHP systems and prioritize the official security patches immediately. If a system cannot be updated promptly, the NSA recommends taking it offline until it can be fully mitigated.
â What organizations should do now:
âą Check every internet-facing system running PHP
âą Identify the PHP version in use
âą Install the latest security release
âą Update related software/packages from vendors
âą Increase monitoring and logging for suspicious activity
âą Review systems for signs of compromise
âą Isolate or take vulnerable systems offline if they cannot be patched
PHP has released security updates including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing the two critical vulnerabilities. (PHP)
â ïž This is not a âpatch laterâ situation.
If you operate a PHP-based website, server, exchange, application or business infrastructure, check it now.
The safest move is simple:
Identify â Patch â Verify â Monitor.
One vulnerable server can become the entry point to an entire organization.
#PHP #CyberSecurity #PHP2Shell #Hacking #InfoSec #CyberAttack #WebSecurity #Technology #SecurityAlert
The NSA has issued an immediate warning to organizations using PHP after two critical vulnerabilities were discovered in the widely used programming language.
These flaws are rated CVSS 9.2/10 (Critical) and can allow unauthenticated remote code execution meaning an attacker may be able to execute malicious commands on a vulnerable server without having to log in first. (PHP)
Why is this serious? đ
đŽ PHP runs on a huge portion of the web and is commonly used for websites, web applications and server-side systems.
đŽ The vulnerabilities, collectively referred to as PHP2Shell, can potentially give attackers access to systems behind vulnerable PHP web services.
đŽ The risk is particularly serious for internet-facing servers, where attackers may be able to exploit the vulnerability remotely.
đŽ The NSA is advising organizations to identify vulnerable PHP systems and prioritize the official security patches immediately. If a system cannot be updated promptly, the NSA recommends taking it offline until it can be fully mitigated.
â What organizations should do now:
âą Check every internet-facing system running PHP
âą Identify the PHP version in use
âą Install the latest security release
âą Update related software/packages from vendors
âą Increase monitoring and logging for suspicious activity
âą Review systems for signs of compromise
âą Isolate or take vulnerable systems offline if they cannot be patched
PHP has released security updates including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing the two critical vulnerabilities. (PHP)
â ïž This is not a âpatch laterâ situation.
If you operate a PHP-based website, server, exchange, application or business infrastructure, check it now.
The safest move is simple:
Identify â Patch â Verify â Monitor.
One vulnerable server can become the entry point to an entire organization.
#PHP #CyberSecurity #PHP2Shell #Hacking #InfoSec #CyberAttack #WebSecurity #Technology #SecurityAlert