Critical PHP flaws put tens of millions of websites at risk

Tens of millions of websites could be at risk from two critical security vulnerabilities in PHP, the programming language, SVT reports. Sweden’s CERT-SE has urged organisations to update affected systems as soon as possible or temporarily disconnect them from the internet.

The flaws could allow attackers to access websites without logging in. In the worst case, they could steal data, install malicious code or take sites offline.

Security updates to address the vulnerabilities are due to be released at 4 p.m. on Wednesday. CERT-SE recommends that organisations identify PHP-based applications, follow vendors’ guidance when updates become available and check systems for signs of intrusion.

PHP 5 and later versions may be affected. The language is used by web tools including WordPress, Drupal and Joomla.

Several government websites have already been taken offline as a precaution. Finland’s government IT centre Valtori has shut down the government’s public web services. In the Netherlands, the lower house of parliament, the Tweede Kamer, has also been temporarily taken offline, the BBC reports.

CERT-SE is Sweden’s national function for warning about and helping to manage serious IT security incidents. It is part of the National Cyber Security Centre, which is under the Swedish Defence Radio Establishment, FRA.