CONNECT WITH US
Tech

Tech

Two dangerous internet security issues are putting site admins on edge

Engadget logo

Published on

Add as a preferred source on Google
Two dangerous internet security issues are putting site admins on edge

The web is a bit of a hot mess today following the discovery of two severe vulnerabilities, according to security releases seen by Ars Technica. The first involves TLS certificates with extremely weak encryption that could affect everything from VPNs to IoT devices. The other is a severe PHP programming language vulnerability impacting CMS systems including WordPress and Drupal. Both problems could result in large-scale attacks and require massive cleanup jobs, security experts said.

gPHP Foundation said on X that it's releasing security patches for two critical vulnerabilities rated 9.2 out of 10 on the severity scale. Ahead of the release today at 14:00 UTC (10AM ET), the group said that "PHP users are encouraged to prepare to update," adding that it will issue an "earlier release if details become public or active exploit evidence."

The advisory follows a report showing video of a tool called PHP2Shell running code on web servers including the latest versions of WordPress, MediaWiki, Symphony, Drupal and other PHP-based sites. The security firm watchTowr claims it has confirmed the vulnerability and that it affects every version from PHP 5 (2004) onward. "According to an unverified report, the vulnerability would let an attacker run their own code on a server running PHP, potentially taking control of it," watchTowr's FAQ on the exploit states.

" With all this, web admins are likely scrambling to patch the issue, so some PHP-based websites could go down briefly while that happens.



Source link
Related Topics:Tech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.