NSA and FBI urge all PHP users to fix newly found flaws or take systems offline
In short
The US National Security Agency said on the 21st that every organisation using the PHP programming language should act immediately on flaws found in it. The FBI posted a similar warning, saying sensitive data and networks could be compromised. Both advised disconnecting systems from the internet if they cannot be updated.
Read the full story 1 min read
The US National Security Agency (NSA) issued a statement on the 21st asking every organisation that uses the PHP programming language to take countermeasures immediately, Sankei Shimbun reported from Washington. The newspaper described PHP as a language used for building websites. The NSA said that without an immediate response, servers' file systems and databases could be accessed without authorisation. [ 1 ]
The NSA asked for prompt updates to correct what it called a serious flaw. If that is difficult, it recommended temporarily disconnecting websites from the internet until the problem is fully resolved. TBS NEWS DIG reported that the FBI likewise called on organisations to disconnect systems from the internet if they cannot apply a fix straight away. [ 1 , 3 ]
The FBI's cyber division posted a similar warning on X on the 21st, according to Sankei. It said the flaw makes malicious cyber attacks possible and that sensitive data and networks could be compromised. TBS NEWS DIG reported that the FBI said two vulnerabilities had been confirmed in PHP. Both outlets said organisations that find they have been compromised should report to the FBI, and TBS added that the affected system should be isolated. [ 1 , 3 ]
The Cybersecurity and Infrastructure Security Agency (CISA) of the Department of Homeland Security also issued a statement. It said no cases of the PHP flaw being exploited had been confirmed at the time of its announcement, but that leaving it unaddressed would pose risk to organisations, and it urged action. Nishi-Nippon Shimbun also carried a report on the FBI warning about the risk of sensitive data being compromised. [ 1 , 2 ]
Why it matters
Sankei Shimbun reported that the NSA asked all organisations using PHP to act immediately, and warned of unauthorised access to server files and databases. The documents say no exploitation had been confirmed when the Cybersecurity and Infrastructure Security Agency (CISA) made its announcement.
Key facts
- The NSA issued a statement on the 21st asking all organisations that use PHP to take countermeasures immediately. [ 1 ]
- The NSA warned that without a prompt response, unauthorised access to servers' file systems and databases could occur. [ 1 ]
- The FBI said on the 21st that two vulnerabilities had been confirmed in PHP. [ 3 ]
- The FBI warned that sensitive data and networks could be compromised. [ 1 , 2 , 3 ]
- CISA said that, at the time of its announcement, no cases of the flaw being exploited had been confirmed. [ 1 ]
- Organisations that find signs of compromise are asked to report to the FBI. [ 1 , 3 ]
Confirmed by several sources
Still unclear
- Whether the PHP flaws have been exploited in attacks. CISA said no exploitation had been confirmed at the time of its announcement; the documents give no later information.
- Technical details of the two vulnerabilities. The documents say the FBI confirmed two vulnerabilities but do not describe them or say which PHP versions are affected.
- The NSA asked all PHP-using organisations to update promptly to fix the flaw. Reported by a single source so far