PHP Disclosure of high-severity vulnerabilities; official security patch release reportedly moved up to October 21

Article

"Internet infrastructure"PHP High-severity vulnerabilities exposed, putting vast numbers of websites worldwide at risk of complete takeover

BlockBeats reports:October 21, according to Huntress, a security crisis that could affect vast numbers of websites worldwide is brewing. The popular programming language used to build the internet PHP has been found to contain extremely serious security vulnerabilities. As relevant information was leaked in advance,PHP officials have been forced to move up the emergency security patch release time to October 21。

It is reported that PHP is the underlying foundation of numerous website-building systems such as WordPress and Drupal, corporate websites, and various web control panels. Because it is ubiquitous, a problem at its core is equivalent to a crack opening in the infrastructure of the entire internet.

These vulnerabilities have been rated by officials at the highest severity level and are “remote code execution” vulnerabilities, codenamed “php2shell.” Put simply, this is like a hacker finding a master key that can directly open the server door. An attacker need only send a specially crafted web request to an affected website to execute arbitrary commands on the server and completely take over the system. More troublingly, the technical details of these vulnerabilities have not yet been fully disclosed, meaning that defenders are in an extremely passive position before the patch is released. As October 20 someone leaked this news early on a forum, officials had no choice but to move the original schedule up to Eastern Time October 21 a.m. 10.

Although the patch will be released shortly, without technical details, security teams worldwide are investigating potential intrusions by monitoring “abnormal behavior” on servers. Cybersecurity company Huntress noted that hackers often leave traces once they successfully exploit the vulnerability. For example, a PHP process that normally handles only web requests may suddenly and abnormally launch a command-line terminal (such as bash), run interpreters such as Python, or invoke tools such as curl to download malicious files. If such abnormal linked operations suddenly appear on a website server, it usually means hackers have already been quietly active in the background.

Huntress stated that time is extremely limited for businesses and website administrators. Before the patch is released, the most urgent task is to comprehensively inventory every place within the company where PHP is running, including not only public-facing web servers but also PHP environments hidden in product devices or control panels. Once the patch is released, systems exposed to the public internet must be patched first. In addition, if a company is still using an old version of PHP that has long ceased to be maintained, it will likely not receive an official fix and must immediately adopt isolation measures such as disconnecting from the internet or upgrading. Meanwhile, for ordinary internet users, if they encounter brief emergency maintenance or inaccessible websites when visiting certain sites recently, this is likely because major platforms are racing against time to repair this “door” and fend off a cyberstorm that could erupt at any time.