Php vulnerabilities, security flaws discovered: sites at risk. Here's what happened

In recent hours, some European institutional sites have been taken offline for precautionary reasons. In particular, what led the experts to suspend the services was the discovery of two significant security flaws in PHP, a programming language used by a significant part of the web. The decision was made to prevent a possible hacker attack that could allow code to be executed on servers without authentication, also obtaining possible access to the information stored in the systems. The first stops were decided in countries such as Finland, the Netherlands, Germany and France.

The problem encountered

In particular, the problem encountered, called "Php2Shell", falls into the category of system vulnerabilities linked to the management of computer memory by Php.

Discovery thanks to AI

The creators of Php, as mentioned, a specific technology that powers around 70% of websites worldwide, have discovered two important security flaws thanks to the use of artificial intelligence and immediately decided to run for cover, making available a series of updates capable of avoiding the worst, that is, the possibility for hackers to take control of any system that uses the same Php software.

The alert and vulnerabilities

In an alert sent directly from the National Cybersecurity Agency, the two vulnerabilities with "critical severity" were promptly reported, as they could potentially be exploited by remote attackers to execute arbitrary code on the affected systems. In detail, the first vulnerability, the agency itself explained, is related to the inadequate management of memory exhaustion conditions. The second, however, is linked to a not entirely appropriate management of the internal global state of Php which, also due to critical errors, timeouts, memory exhaustion conditions or certain diagnostic operations, could maintain references to memory already freed.

The recommendation

Given the potentially critical situation, the Cybersecurity Agency has in fact recommended updating vulnerable products by scrupulously following the indications of the security bulletins forwarded. If it was not possible to apply the necessary security updates immediately, the idea was to take sites and web services that use vulnerable versions of Php offline, suspending their accessibility until the entire update procedure was completed. A similar alert, among other things, also came from the American National Security Agency, which spoke of flaws that "often provide direct access to the file system or server database".

The situation in Germany and France

Among the countries involved, as mentioned, there is also Germany. Here the Federal Information Technology Security Agency has classified the risk of flaws as "extremely high". The alarm raised by Berlin led some institutions, including some hospitals, to temporarily deactivate their online services. Even in France, the websites of all French prefectures were inaccessible for some hours following the discovery of vulnerabilities and the need to subject them to "preventive maintenance".