CONNECT WITH US
Tech

Tech

US NSA, India's CERT-In warn of critical PHP flaws that could let hackers take over servers

CNBCTV18 - Tech logo

Published on

Add as a preferred source on Google
US NSA, India's CERT-In warn of critical PHP flaws that could let hackers take over servers

Government agencies and companies around the world took websites and online services offline on Wednesday as cybersecurity officials warned that critical flaws in PHP, a programming language widely used to build websites, could allow hackers to take control of vulnerable servers.

The US National Security Agency (NSA) urged organisations to immediately install security patches or take affected systems offline until they can be secured. India's cybersecurity agency CERT-In also classified the vulnerabilities as critical, warning of a high risk of remote code execution and complete system compromise.

PHP is an open-source programming language used to build websites and web applications, allowing web servers to generate dynamic content. The technology underpins popular web design platforms and is used across a wide range of services, from online stores and news websites to government portals.

The vulnerabilities, collectively dubbed “PHP2Shell”, could allow attackers to execute malicious code on affected servers without needing a password or prior access. Successful exploitation could enable them to steal sensitive data, disrupt services or gain access to a server's file system or database.

According to CERT-In's advisory dated October 21, the flaws affect PHP versions earlier than 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The agency said the vulnerabilities stem from memory corruption and improper resource control, which attackers could exploit by sending specially crafted requests to targeted systems.

The flaws affect systems running vulnerable PHP versions on their own servers. Not all websites are exposed, as some platforms use other programming languages or rely on operators that can quickly apply security fixes.


Source link
Related Topics:Tech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.