CERT-IS warns hundreds of Icelandic servers may be vulnerable

Hundreds of Icelandic web servers may be exposed to a serious security flaw, mbl.is reports, though CERT-IS has received no reports of break-ins linked to it. Magni R. Sigurdsson, head of CERT-IS, the Telecommunications Agency’s cybersecurity response team, said operators in Iceland had reacted quickly.

CERT-IS warned on Wednesday about two critical vulnerabilities in PHP, a programming language used by many websites. The flaws could allow attackers to take control of vulnerable systems over the internet.

A scan on Wednesday found that at least 500 to 600 Icelandic IP addresses were connected to systems that could be vulnerable, Magni told mbl.is. CERT-IS is monitoring how quickly operators update their systems.

New information suggests hackers may have started exploiting the vulnerabilities earlier than previously thought. Amazon has reported indications of possible exploitation dating back to October 17, four days earlier than the date previously cited. Magni said operators should review their system logs from that date, or even earlier, for suspicious activity.

The threat will persist until operators update their systems, Magni said. Exploitation is already taking place around the world, and smaller organisations may have fewer resources to apply updates quickly.

If exploited, the flaw could give attackers full control of a web server, allowing them to access stored data or install malicious software and other files. In some cases, visitors to affected websites could also be affected. Magni said he considered information theft, with the stolen data then used in further cyberattacks, a more likely outcome.