Post

James Ball
@jamesrball.com

This PHP vulnerability *is* why lots of sites – especially government ones – are suddenly offline, but it's *not* because they've been hacked. Instead, they've been pulled offline until they can be made secure again. It's a bit of a mess. Short thread.

78 reposts247 likes

Tim Hill of Antifa, #FBPE
@tjrh.uk

3 wks ago, 1 of my (php) sites had to be taken offline. 9m resource requests in 24 hours and every one was with a bloated, seemingly nonsense URL. Small numbers of such 'visitors' are a constant nuisance on the www but something (AI?) has taken this to another level. It's been Cloudflared now.

ThinkGov
@thinkgov.bsky.social

Hostinger tell me they have the problem covered. I can DM details if you like. Will investigate with my other hosting platforms.

James Ball
@jamesrball.com

Researchers (with help from AI) discovered a major vulnerability in PHP, a scripting language used to power around 70% of websites. If exploited, it allowed an attacker to get full access. Thankfully, they waited for a patch before disclosing it. But…that patch needs applying and testing.

James Ball
@jamesrball.com

The moment a vulnerability like this is announced, a race starts between people looking to exploit it, and those needing to secure their systems. This one is a particular nightmare as lots of background and largely forgotten bits of infrastructure use it. Expect to see lots of hack-and-leaks soon.

James Ball
@jamesrball.com

So…given how high risk this vulnerability is, and how many possible attack vectors (routes in for an attacker) there are, some places are doing the equivalent of yanking out the power cord until the dust settles. That could prove to be a very good idea, tbh. It's gonna be an interesting few days.

AI Ready Hub
@aireadyhub.bsky.social

The applying part is where small businesses get stuck: many don't know which PHP version their site runs. Your hosting control panel usually shows it, or ask your host directly. Fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; 8.1 and older need an upgrade.

ianVisits
@ianvisits.co.uk

I was relaxed as my hosts are handing the php patch for me and deploying right now... until I remebered that other server I have elsewhere for other things, and oh, bugger.

alex
@mostfoolhardy.bsky.social

if your website needs php then that need will introduce security vulnerabilities however it is addressed and you'll always be partly responsible. if your website is static and you don't need it then what you need is an object store with a cdn in front of it.

Hughstergeist
@hughster.bsky.social

Not suggesting you're doing anything else, and I'm sorry if that's how it came across. I was just clumsily observing that it's a good rule to follow

Angus Sawyer
@aardgoose.info

Who are lagging in fixing things and encourage customers to not upgrade by providing custom "patched" versions of long obsolete versions. One has just retired PHP 5.1 and PHP 5.2 with no notice.