Cloudflare reports early attacks exploiting PHP vulnerabilities

Cloudflare is seeing early attacks exploiting critical vulnerabilities in PHP, the programming language used across much of the internet, the company’s chief technology officer, Dane Knecht, said on Wednesday. He said Cloudflare was updating its defences, but warned they were only a stopgap until users install a fix. [1]

The PHP developers were due to release patches for two vulnerabilities at 14:00 GMT on Wednesday. Both were rated 9.2 out of 10 on the CVSS v4.0 severity scale, according to Reuters. The flaws could allow unauthenticated remote code execution, meaning an attacker may be able to run code on a vulnerable system without logging in. [1]

CERT-EU advised organisations to prepare to patch PHP-based applications as soon as fixed versions become available. If they cannot patch immediately, it said they should consider isolating internet-facing applications from public networks until a fix can be applied. The agency said technical details had not yet been made public. [2]

The Australian Cyber Security Centre issued similar advice but said it was not aware of active exploitation related to the vulnerabilities. [1]