The Dutch National Cyber Security Centre (NCSC) is investigating the first signs of successful exploitation of two critical vulnerabilities in PHP. These vulnerabilities allow attackers to take over systems remotely. Patches are available. The NCSC advises updating immediately and keeping vulnerable systems offline until then.
The NCSC reported the vulnerabilities on 21 October and published an update on 22 October. As a precaution, the centre temporarily took its own website offline. Several other organisations, including government agencies, also took their websites down pre-emptively. Since the advisory was published and the security updates were released, several of those websites have come back online.
PHP is a widely used programming language for websites and web applications. The vulnerabilities therefore affect a broad range of environments, from in-house web servers to third-party software built on PHP.
Proofs of concept available
According to the NCSC, the situation could escalate quickly because proofs of concept (PoCs) are known. These demonstrate that the vulnerabilities can be exploited in practice. The centre also points out that attackers may be able to exploit the vulnerabilities even faster with the help of AI. The NCSC therefore strongly urges organisations not to wait for signs of exploitation and to install the available updates immediately.
As long as systems have not been updated, the NCSC advises keeping them offline as a precaution. To do so, first check which PHP version your organisation or your client is using. Then follow the instructions from the NCSC and from the relevant software vendor.
Available patches
The PHP project has released patches. You should upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you use a Linux distribution or an LTS version, apply the security updates provided by your vendor.
PHP 8.1 and earlier fall outside the PHP project’s regular support. Given the severity of the vulnerabilities, however, the PHP team has made minimal source code patches available for PHP 7.4, 8.0 and 8.1. The NCSC does not mention any patches for versions older than 7.4.
Temporary measures
If you cannot update immediately, temporary mitigation measures are available for both vulnerabilities. The PHP team stresses that these measures only restrict specific attack paths and do not constitute a complete solution. Only a security update fully resolves the vulnerabilities.
Decision tree and technical details
The NCSC has published the guidance with a decision tree for PHP vulnerabilities. Using this decision tree and the accompanying explanation, you can determine which measures you can take if you use PHP.
In addition, the NCSC maintains a GitHub page called php2shell with technical information about the vulnerabilities. The centre updates this page continuously. The page also contains an inventory of PHP-related software products, so you can check which products are vulnerable.
The full report can be read via the guidance with a decision tree for PHP vulnerabilities.
This article was originally published in Dutch on MSP Business. Read the original →
