Advania urges PHP website updates after serious vulnerabilities leak

People and businesses using websites built with PHP should update them immediately, Guðmundur Arnar Sigmundsson, head of cybersecurity and data development at Advania, told mbl.is. He described two vulnerabilities disclosed in the PHP web platform as “among the most serious I can remember.”

The flaws could allow unauthorised users to run code on internet-accessible servers running PHP, including services Advania operates for clients. CERT-IS, the Icelandic government’s cybersecurity response team, issued instructions shortly before 2 p.m. on how to update websites and limit potential damage.

Advania began taking preventive measures with clients on Wednesday morning after reports of the issue began circulating the previous day. The measures included temporarily taking websites offline. Sigmundsson said he did not have an exact figure for how many Advania clients were affected.

He said the disclosure set off a race between defenders and attackers to protect or target systems. Artificial intelligence has transformed cybersecurity, he added, making attacks a matter of minutes or even seconds.

Sigmundsson said he was not aware of any attacks exploiting the vulnerabilities, at least not against Icelandic websites, or of anyone suffering actual damage from their use. He said the response had nevertheless caused disruption.