Patch PHP before crooks get in
NCSC NZ is urging immediate patching for a critical PHP vulnerability that could let attackers seize control of exposed websites and web services.
NCSC NZ has issued an official advisory about a critical PHP vulnerability affecting a widely utilised scripting language found in many websites and web services used by New Zealand organisations. If your business runs PHP anywhere in its environment, you should treat this as urgent and check whether those systems are exposed.
The risk is serious because an attacker could use this flaw to take full control of a website, web server, or web service. In plain terms, that means your public site could be defaced, taken offline, or used as a way into underlying systems if you do not patch promptly.
NCSC says it has already warned cyber security customers and trust groups to stay alert, monitor official PHP guidance, and apply updates as a priority. A patch was released at 0300 NZDT by the PHP Foundation, but patching now will only protect systems that have not already been compromised.
You should apply the available PHP security patch immediately, then review vendor guidance for any products and services in your environment that rely on PHP. You should also actively monitor logs and signs of exploitation, because an already exploited system may need further investigation and response.
Source: NCSC New Zealand — https://www.ncsc.govt.nz/news/ncsc-encourages-immediate-patching-against-php-vulnerability/
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Review whether your websites, web services, applications, or hosting environment utilise PHP anywhere in your environment.
- Check: Confirm PHP patch status immediately, apply the latest security update, and review server and application logs for any signs of exploitation or unexpected changes.
- Do not: Ignore vendor or agency advisories. Prompt action within the recommended timeframe reduces your exposure significantly.
- Report: If you find affected systems or signs of compromise, contact your IT provider immediately, and report suspected active exploitation to NCSC NZ at report.ncsc.govt.nz.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
The Local Vocal is published by Decision1 IT Solutions. If one of these landed in your inbox, or someone in the team clicked, give us a call.