Dutch cybersecurity centre lowers assessment of large-scale PHP attack risk

The Dutch National Cyber Security Centre (NCSC) says the risk of large-scale attacks exploiting two recently disclosed PHP vulnerabilities is lower than it first estimated, after further investigation found that exploiting them is complicated.

Many websites in the Netherlands use PHP. The flaws came to light earlier this week, and numerous sites were taken offline as a precaution on Wednesday while operators installed a patch released by the PHP Foundation. Many have since returned online. The NCSC says the updates appear to be working so far.

The centre also reported that the PHP Foundation disclosed another vulnerability on Friday. The foundation considers it unlikely that the flaw could be used to take control of devices remotely, according to the NCSC. The issue is due to be fixed in a future routine update.

The NCSC had previously reported attempted attacks on the first vulnerabilities, but no successful exploitation. It has warned that attacks could still become possible if a working method is developed. Its earlier update on the PHP flaws said researchers and attackers had shared test or exploit code, but the centre’s investigation had not found that code to work successfully.