Global Alert Issued as Two Major PHP Vulnerabilities Expose Millions of Services to Cyber Risks
BENGALURU: Two critical vulnerabilities in PHP have raised a cybersecurity alert, potentially exposing millions of internet-facing services to remote code execution by hackers. PHP has advised users to temporarily disable a file-upload tracking feature to mitigate another risk, compounding concerns over the widely used programming language.
PHP issued a warning on October 23, urging users to disable its session upload progress feature until the next bugfix release. This advisory followed an earlier warning on October 21 regarding a related vulnerability. The latest issue affects applications only when specific session settings are altered while the upload progress feature remains enabled. Users who have already disabled this feature do not need to take further action.
PHP Vulnerabilities and Their Impact
The vulnerabilities, collectively referred to as PHP2Shell, pose significant security risks for organizations reliant on web applications. Aamir Lakhani, global director of threat intelligence at Fortinet, emphasized the urgency of addressing these flaws, which threaten business continuity for companies utilizing websites and customer portals.
The scale of potential exposure is considerable. Censys reported approximately 36.7 million internet-facing services running potentially affected PHP versions as of October 22. These figures represent service counts rather than unique servers or organizations and may include installations already patched by vendors.
Installation Statistics and Risks
Qualys found 167 million PHP package installations across 12,000 organizations, with 73% deployed on internet-facing assets. Saeed Abbasi, head of the Threat Research Unit at Qualys, noted that simply applying a patch is insufficient for systems running unsupported versions, making upgrades the only viable long-term solution. He stated that nearly all PHP installations are either vulnerable or operating on unsupported versions.
CloudSEK’s analysis revealed that Shodan identified 2.2 million internet-facing services displaying PHP information globally, with India ranking ninth at 53,400 services. Of the 36,700 Indian services revealing their PHP versions, approximately 36,100 were unpatched, including 19,500 running versions that have reached end of life, according to security researcher Akash Karthi.
Observer Voice is the one stop site for National, International news, Sports, Editor’s Choice, Art/culture contents, Quotes and much more. We also cover historical contents. Historical contents includes World History, Indian History, and what happened today. The website also covers Entertainment across the India and World.
