The PHP hypertext preprocessor on most major operating systems is vulnerable to exploitation and hacking.
The National Security Agency (NSA) and Central Security Service issued an advisory on Wednesday about critical patches for vulnerabilities in PHP: Hypertext Preprocessor (PHP), which works on most major operating systems and runs directly on web servers. PHP is often added to HTML to make dynamic web pages.
“We are prioritizing identification of malicious cyber actors that may seek to exploit these vulnerabilities, collectively nicknamed ‘PHP2Shell,’ and recommend organizations take the following precautions,” the NSA explained. “‘PHP2Shell’ could allow attackers to take control of affected web servers without prior access or authentication. Such an access vector could help attackers steal sensitive data, disrupt services, or move deeper into a network. These vulnerabilities are flaws in PHP itself, not in the hosted application or its configuration. Servers running affected PHP versions are exploitable.”
The agency recommended that organizations “maintain heightened awareness of your internet-facing devices and services that are reliant on PHP” and “prioritize incorporating vendor patches that may be explicitly tied to the PHP2Shell issues.”
The NSA advised, “All users should immediately conduct an inventory, where feasible, of hardware/software services reliant on now-vulnerable PHP versions. Vigilance in applying patches related to those systems is paramount.”
[Editor’s note: While this issue may have impacted some services of The Presidential Prayer Team, they have already been addressed by the engineering team.]
As the Lord Leads, Pray with Us…
- For General Joshua Rudd as he heads U.S. Cyber Command, the National Security Agency, and Central Security Service.
- For U.S. officials as they assess the status of cyber security in the nation and issue advisories.
- For American organizations to be discerning in addressing the vulnerabilities and risks to their files and updates for their systems.
Sources: National Security Agency/Central Security Service, CNBC, MSN
