CONNECT WITH US
eCommerce

eCommerce

The vulnerability beneath the checkout: why the PHP scare was a wake-up call for retail

InternetRetailing logo

Published on

Add as a preferred source on Google
The vulnerability beneath the checkout: why the PHP scare was a wake-up call for retail

Following the cyberattacks on ASOS, Whistles & Hobbs and Intermarché, another major cybersecurity story emerged this week. Researchers identified two critical vulnerabilities in PHP, the programming language that underpins many websites and web applications, including those built on platforms such as WordPress and Magento. The flaws could allow unauthenticated remote code execution, potentially enabling an attacker to take control of a vulnerable web server without needing to log in.

Details of the vulnerabilities became public on 20 October, before the planned release of security fixes. The PHP project responded by issuing emergency patches on 21 October. As organisations worldwide rushed to update their servers, a number of government agencies and other organisations temporarily took websites and online services offline as a precaution while patches were deployed and systems checked for exposure.

There is currently no public evidence that hostile agents managed to exploit the vulnerabilities before the fix was deployed, but from a retail perspective, the potential threat was extremely severe. Many retail platforms and content sites run on PHP, and the risk wasn’t specifically a WordPress bug or a Magento bug; it was in the underlying PHP runtime itself. A retailer could have fully updated application software and still be vulnerable if the server PHP version wasn’t patched.

The incident yet again highlights the extent to which retailers depend on technology beyond their direct control. COM , described it as a “wake-up call” for ecommerce businesses and warned that they must now ascertain whether attackers have gained access to their data.


Source link
Related Topics:eCommerce

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.