CERT-IS, Iceland’s cyber security incident response team, has warned that two very serious vulnerabilities have been found in PHP and could affect a vast number of websites and services. The security flaw threatens a vast number of websites built with popular systems including WordPress, Drupal and Joomla, which all rely on PHP. The warning was reported by DV and several Icelandic media outlets on Wednesday.
According to CERT-IS, the vulnerabilities could allow attackers to take control of sensitive systems over the internet. The agency strongly advises companies and institutions running PHP systems to install upcoming security updates as soon as they become available. If updates cannot be applied immediately, CERT-IS recommends imposing access restrictions or shutting down affected systems temporarily to limit risk.
Security updates for the affected PHP systems are expected to be released at 14:00 on Wednesday, 21 October. CERT-IS warns that the public may notice temporary disruptions to web services while these updates are implemented and further protection measures are put in place.
Several countries in Europe are already taking action to mitigate the impact. The Netherlands has taken down an identity service website, a major news portal and some parliamentary pages as a precaution. Finland, according to CERT-IS, has planned similar precautionary measures.
Magni R. Sigurðsson of CERT-IS stated, “Two very serious vulnerabilities were found in the PHP programming language.” In a statement from CERT-IS, the agency said, “If updates cannot be applied immediately, access restrictions or temporary shutdowns may be needed.” Both quotes were translated from Icelandic.
Sources
- Stjórnarráð Íslands (Government of Iceland) in Icelandic
- RÚV in Icelandic
- mbl.is in Icelandic
- Vísir in Icelandic
- mbl.is in Icelandic
- Fréttatíminn in Icelandic
