PHP vulnerabilities exposed hundreds of Icelandic web servers

Hundreds of Icelandic web servers were vulnerable to two serious security flaws in PHP, the programming language, mbl.is reported. The vulnerabilities affect the servers themselves, which host more than 70 per cent of websites online, said Ingólfur Andri Ágústsson, a specialist at Opnum kerfum.

CERT-IS, Iceland’s cyber security response team, warned about the flaws on Wednesday. No reports of related break-ins had reached the team in Iceland, although attacks on websites abroad had been reported, Ágústsson said.

Companies moved quickly to block network traffic to affected servers and update the code library on them. The technology has been in widespread use for a long time, he said, and some users may not realise their systems rely on it.

An artificial intelligence scanning tool discovered the vulnerability, which was rated 9.2 out of 10 for severity. AI tools are increasingly being used to scan for weaknesses, Ágústsson said, but human review is still needed to confirm that their findings are correct.