FSB-linked centre tells critical infrastructure to restrict sites over PHP flaws
In short
The National Coordination Centre for Computer Incidents (NKCKI), which operates under the FSB, told operators of critical information infrastructure on 22 October to install the fixed version of PHP. If that cannot be done quickly, they are to consider restricting external access to vulnerable web servers, up to shutting them down. The order follows two critical PHP vulnerabilities rated 9.2 out of 10, one of them found with the help of artificial intelligence.
Read the full story 2 min read
The National Coordination Centre for Computer Incidents (NKCKI), which operates under the FSB, has instructed Russian organisations that run critical information infrastructure to temporarily restrict access to vulnerable websites if they cannot quickly update PHP. iXBT reported that owners of such systems received a letter dated 22 October. The document covers state bodies, financial organisations, energy and transport enterprises, medical institutions and other critical facilities. RBC first reported the letter on 22 October, and Habr News said three recipient organisations had confirmed its authenticity to RBC. [ 1 , 2 , 4 ]
According to iXBT, the NKCKI requires recipients to install the fixed version of PHP, scan servers with antivirus software and examine event logs for signs of compromise. Where software cannot be updated quickly, organisations should consider restricting external access to vulnerable web servers, up to disconnecting them entirely. Suspicious incidents are to be reported to GosSOPKA, the state system for countering cyberattacks, through which the directive was distributed, according to Kommersant and Habr News. TASS's summary says the NKCKI advises updating PHP first to the latest versions in which the vulnerabilities are fixed. [ 2 , 3 , 4 , 5 ]
The cause is two critical PHP vulnerabilities, one of which was found with the help of artificial intelligence, iXBT wrote. They allow attackers to attack sites remotely, take control of a server and extract confidential data from its memory, including passwords and cryptographic keys. The flaws were rated 9.2 out of 10 for severity. Kommersant said the developers reported the AI-assisted discovery on 20 October and announced a fixing update the next day; iXBT said emergency updates for both problems were released on 21 October. [ 2 , 3 ]
iXBT cited W3Techs data that PHP is used by 90.8% of Russian-language sites and 69.3% of all sites in the world. It added that updating WordPress, Drupal or Joomla does not solve the problem on its own, because the vulnerabilities affect PHP itself. Kommersant said more than 90% of Russian-language sites run on PHP, which it said put tens or hundreds of thousands of Runet resources at risk. [ 2 , 3 ]
RBC's summary said sites had been switched off in large numbers around the world because of the vulnerabilities. iXBT said authorities and cybersecurity specialists in several countries urged site owners to install the fixes and, if necessary, to disable sites temporarily, and that some government bodies and organisations in Europe and Japan had already restricted access to their resources. Habr News said cybersecurity centres in other countries issued similar recommendations, but that in Russia the instruction on specific software comes directly from an FSB structure. [ 1 , 2 , 4 ]
Why it matters
PHP runs 90.8% of Russian-language websites and 69.3% of all websites, according to W3Techs figures cited by iXBT, so the flaws touch a very large number of sites. Habr News noted that the instruction on specific software comes directly from an FSB structure, and said centres in other countries issued similar recommendations.
Key facts
- NKCKI, which operates under the FSB, sent a letter dated 22 October to owners of critical information infrastructure, covering state bodies, financial, energy, transport and medical organisations and others. [ 2 , 3 , 4 ]
- The letter tells recipients to install the fixed PHP version, scan servers with antivirus and examine logs for possible compromise. [ 2 , 3 , 4 ]
- If PHP cannot be updated quickly, recipients are to restrict external access to vulnerable web servers or switch them off completely. [ 2 , 3 , 4 ]
- Suspicious incidents are to be reported to GosSOPKA, the state system for countering cyberattacks. [ 2 , 4 ]
- Two critical PHP vulnerabilities, rated 9.2 out of 10, allow remote attacks on sites and control of the server. [ 2 , 3 ]
- Developers announced the AI-assisted discovery on 20 October and released emergency updates on 21 October. [ 2 , 3 ]
- W3Techs data cited by iXBT puts PHP use at 90.8% of Russian-language sites and 69.3% of all sites worldwide. [ 2 ]
Confirmed by several sources
- NKCKI at the FSB instructed critical-infrastructure operators to update PHP and, where that is not possible quickly, to restrict external access to vulnerable web servers or shut them down. [ 1 , 2 , 3 , 4 , 5 ]
- The instruction was prompted by two critical PHP vulnerabilities rated 9.2 out of 10. [ 2 , 3 ]
- The letter was distributed through the GosSOPKA system and asks recipients to scan servers with antivirus. [ 3 , 4 ]
Still unclear
- Whether the letter orders a shutdown or only asks recipients to consider restricting access. RBC's summary says sites are to be disabled temporarily, while iXBT and Habr News say organisations must consider restricting access up to a full shutdown.
- Authenticity of the letter. Habr News says three recipient organisations confirmed it to RBC; the other documents do not mention this.
- How many Russian sites are actually at risk or have been taken offline. Kommersant says tens or hundreds of thousands of Runet resources are under threat, but no document gives a count of affected or disabled Russian sites.