Dutch cybersecurity centre reports no successful exploitation of PHP flaws so far

The Netherlands’ National Cyber Security Centre (NCSC) has not detected active exploitation of vulnerabilities in PHP, its director, Matthijs van Amelsfort, said on Wednesday evening. He also warned that online traffic is rising, which he said suggests people are searching for websites that may still be vulnerable.

Several websites were taken offline as a precaution after critical flaws in PHP, a programming language used to build websites, were identified. Some have since returned online after installing an update released at about 4pm, according to the ANP report published by Nieuws.nl.

The NCSC has urged organisations to check their systems for vulnerabilities and apply available updates as soon as possible.

Update

The Netherlands’ National Cyber Security Centre (NCSC) says it has not yet seen successful exploitation of vulnerabilities in PHP, but warns that a working attack method could enable attacks on a larger scale.

The centre said on Thursday that the activity it had observed so far consisted of attempted attacks. It also reported no current indication that available patches were inadequate to fix the vulnerabilities.

Researchers and attackers have posted examples of code online that can be used to test or exploit the flaws. The NCSC said its own investigation found that these so-called proof-of-concept examples had not yet worked successfully.

The Dutch Data Protection Authority said it had received no reports on Thursday of data breaches caused by the PHP vulnerabilities. The NCSC cautioned that the lack of successful exploitation so far does not rule out future attacks: “One working variant may be enough to enable attacks on a larger scale.”

The PHP Foundation has separately reported that it has seen no signs of active exploitation of PHP vulnerabilities. That assessment does not rule out future attacks, which the NCSC says remain possible.