China warns of critical PHP remote code execution vulnerabilities
China's Ministry of Industry and Information Technology has issued a risk alert over two critical PHP remote code execution vulnerabilities, urging users to upgrade immediately. The vulnerabilities could allow unauthenticated attackers to execute arbitrary code, compromising servers and causing data
China's Ministry of Industry and Information Technology (MIIT) has issued a risk alert over two critical remote code execution vulnerabilities in PHP, urging affected organisations and users to conduct thorough inspections and upgrade to the latest security version without delay. The ministry also recommended temporary measures such as taking systems offline, disabling session upload progress functions, network isolation, and restricting network access.
The warning was published through the ministry's National Vulnerability Database (NVDB), a platform for sharing cybersecurity threats and vulnerability information. The NVDB advised strengthening cybersecurity monitoring and management, and promptly updating credentials such as accounts and keys to guard against cyberattacks.
According to the platform, the two vulnerabilities are rated as critical because they allow unauthenticated attackers to remotely execute arbitrary code. Exploitation could lead to server compromise, leakage of sensitive information, and service disruptions.
PHP is a widely used open-source server-side scripting language for web development. Data from web technology tracking firms shows that nearly 70 per cent of websites with identifiable programming languages are powered by PHP.
After the serious vulnerabilities were disclosed, multiple government websites in Europe were taken offline as a precaution. Website operators worldwide have been implementing protective measures to avoid system compromise.
