CERT-IS warns of critical vulnerabilities in PHP systems

Iceland’s CERT-IS cybersecurity team has warned of two very serious vulnerabilities in PHP, the programming language used by many websites. The flaws could allow attackers to take control of vulnerable systems over the internet, mbl.is reports.

Companies and institutions operating PHP systems are urged to install security updates as soon as they become available. The updates are expected at 2 p.m. on Wednesday, October 21. If they cannot be installed, access to affected systems may need to be restricted or the systems temporarily taken offline.

Many websites built on the WordPress, Drupal and Joomla content management systems use PHP. All three systems are written in the language.

According to a notice from Iceland’s Ministry for Foreign Affairs, the Netherlands has taken down the website of its identity service, a major news website and several parliamentary websites. Finland is planning similar measures.

The public may experience temporary disruptions to some online services while updates and other protections are put in place.