'Internet Foundation' PHP Exposes Critical Vulnerability, Massive Global Websites Face Complete Takeover Crisis
BlockBeats news, October 21 - According to huntress, a security crisis potentially affecting a massive number of websites worldwide is brewing. PHP, a popular programming language used to build the internet, has been exposed to two extremely severe security vulnerabilities. Due to the early leak of related information, the PHP official team has been forced to announce that the emergency release of security patches has been moved up to October 21.
It is reported that PHP is the underlying foundation for numerous website-building systems such as WordPress and Drupal, corporate official websites, and various network control panels. Because it is ubiquitous, once a problem arises in its core, it is equivalent to a crack appearing in the infrastructure of the entire internet.
These two vulnerabilities have been rated at the highest severity level by the official team, belonging to "remote code execution" vulnerabilities, codenamed "php2shell." Simply put, this is like hackers finding a master key that can directly open the server door. Attackers only need to send a specially crafted network request to an affected website to execute arbitrary commands on the server and completely take over the system. What is more troublesome is that the technical details of the vulnerability have not yet been fully disclosed, which means that before the patch is released, defenders are in an extremely passive position. Because someone leaked the information on a forum ahead of schedule on October 20, in order to prevent hackers from exploiting it first, the official team had to move the original plan up to 10 AM Eastern Time on October 21.
Although the patch is about to be released, in the absence of any technical details, security teams around the world are investigating potential intrusions by monitoring servers for "abnormal behavior." Cybersecurity company Huntress pointed out that when hackers successfully exploit the vulnerability, they often reveal telltale signs. For example, a PHP program originally responsible only for handling web requests may suddenly and abnormally launch command-line terminals (such as bash), run interpreters such as Python, or invoke tools such as curl to download malicious files. If such abnormal linked operations suddenly appear on a website server, it usually means that hackers are already quietly active in the background.
Huntress stated that for various enterprises and website administrators, the time left for them is already very tight. Before the patch is released, the most urgent task is to comprehensively inventory all places within the company where PHP is running, including not only external web servers but also PHP environments hidden in product devices or control panels. Once the patch is released, systems exposed to the public internet must be prioritized for patching immediately. In addition, if enterprises are still using old versions of PHP that have long ceased to be maintained, they will likely not be able to wait for an official fix and must immediately take isolation measures such as disconnecting from the network or upgrading. At the same time, for ordinary internet users, if they encounter brief emergency maintenance or inaccessibility when visiting certain websites in the near future, this is very likely because major platforms are racing against time to repair this "door" in order to withstand this cyber storm that could break out at any moment.
