CERT-IS identifies hundreds of potentially vulnerable Icelandic servers

Hundreds of Icelandic servers may be exposed to serious security flaws in PHP, the programming language used by many websites, mbl.is reports. CERT-IS, the cybersecurity response team of the Communications Authority, has received no reports of breaches linked to the flaws, and says operators have responded quickly.

CERT-IS warned on Wednesday about two serious vulnerabilities that could allow attackers to take control of vulnerable systems over the internet. A scan found that 500 to 600 Icelandic IP addresses were connected to systems that might be at risk. CERT-IS is monitoring how quickly operators update their systems.

Magni R. Sigurðsson, head of CERT-IS, said new information suggests hackers may have started exploiting the vulnerabilities earlier than first believed. Amazon has reported indications of possible exploitation dating back to October 17, four days earlier than previously thought.

Operators should review their system logs from that date, or further back, to check for suspicious activity, Magni said. The risk will persist until systems are updated, and the process may be more complicated for some operators than others.

If exploited, the flaws could give attackers full control of a web server and access to data stored on it. Attackers could also install malicious software or other data. In some cases, this could affect people visiting the websites, though Magni said stealing information for use in further cyberattacks was a more likely outcome.