Global website flaw puts advisor websites at risk as attacks begin
The Canadian Centre for Cyber Security issued an advisory on Wednesday urging administrators to update. Counterparts in the US, UK, Australia and the European Union went further, telling organizations to take systems offline if they couldn’t patch right away.
Attackers have moved quickly. Security firm watchTowr says its network of decoy servers has recorded attempts to exploit both flaws, and web security firm Patchstack says it has confirmed several attacks, though it hasn’t published details. Neither flaw had been added to the US government’s list of known exploited vulnerabilities by Wednesday evening. Exploit code is circulating publicly.
Organizations around the world have taken websites offline while they waited for the fix. They included parts of Wikipedia, government portals in the Netherlands, Finland and France, and, in Quebec, the Centre de services scolaire Marie-Victorin.
What is PHP?
PHP builds a web page each time someone visits it, pulling information such as account details or login screens from a database and sending the result to the browser. Danish-Canadian programmer Rasmus Lerdorf created it in 1993. It sits underneath WordPress, Drupal and many hosting platforms. Because the flaws are in PHP itself, a website can be exposed even if its own code is sound.
