CONNECT WITH US
Gaming

Gaming

'We expect mass attacks to start within 15 minutes of the release': Web admins braced for emergency PHP updates to plug leaked high-severity holes

PC Gamer logo

Published on

Add as a preferred source on Google
'We expect mass attacks to start within 15 minutes of the release': Web admins braced for emergency PHP updates to plug leaked high-severity holes

The PHP security team has given advanced notice of an upcoming fix for two critical security vulnerabilities, both rated at 9.2 out of 10 on the CVE severity scale.

Info about the flaws seems to have leaked ahead of their official disclosure, as a video is being shared which reportedly shows a tool called PHP2Shell being used to remotely execute code on webservers via the vulnerabilities (via Ars Technica).

The PHP programming language is widely used across the internet and powers a huge number of websites. The fix is due to be released at 2pm UTC (10 am ET). Researchers from cybersecurity firm Sansec say the vulnerabilities affect all web servers running PHP 5.4 or later, and that "we expect mass attacks to start within 15 minutes of the release."

Dane Knecht, the chief technology officer for Cloudflare, says the company is already updating its firewall rules for PHP sites. "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a stopgap only," Knecht posted on X. "Patch as soon as @ThePHPF releases the update at 14:00 UTC today."

Speaking to Bleeping Computer yesterday, the CEO of cybersecurity firm WatchTowr, Benjamin Harris, said: "In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET."

"While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real.


Source link
Related Topics:Gaming

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.