These vulnerabilities put many websites at risk. PHP is a programming language that 70% of websites use. Earlier this week, researchers discovered a vulnerability within PHP that could allow attackers to gain access to sites’ inner workings, steal sensitive information, create backdoors that let them access the site in the future, and engage in other nefarious activities. PHP’s ubiquity makes these vulnerabilities especially dangerous. “It quietly powers online shops, news sites, school portals, and small-business pages,” said Martin Zugec, technical solutions director at the digital-security company Bitdefender.“Because of this flaw you could be exposed to malware, data breaches, or scams based on data leaked from these sites,” said Cooper Quintin, a senior staff technologist at the Electronic Frontier Foundation.There is a fix, but it’s not something you personally put into action. The PHP Foundation, which manages the open-source technology, released a series of patches this week that should prevent the vulnerabilities from being exploited. Websites around the world, from online storefronts to government portals, went offline as a precautionary measure. But attempts to take advantage of the vulnerabilities increased just before the patch was released, according to The New York Times. Ars Technica reported that a video of an exploit tool has been circulating online.Zugec told me, however, that Bitdefender has yet to see any examples of the PHP vulnerabilities’ being exploited. “When researchers announce a flaw, they’re saying a type of lock can be picked,” explained Zugec. “Criminals can’t use that until someone publishes a working way to do it, a master key. That hasn’t happened here.”If you have a website, check to see if you need to update it. “If you run your own blog or small-business website, it is imperative that you update immediately,” said Chris Fistonish, a cybersecurity expert at Malwarebyte’s ThreatLab. Check your web-hosting service for information on how to apply any relevant updates. If you use a platform such as WordPress, Drupal, Joomla, Magento, or similar, check its official announcements for update information.Be especially careful to follow instructions only from trusted sources. Attackers and scammers may try to take advantage of the confusion by providing bad information.Watch out for suspicious activity, now and in the future. Zugec said that criminal groups called initial access brokers are on the hunt for exactly these kinds of vulnerabilities. “They break into servers and later sell that access to other criminals, including ransomware gangs,” said Zugec. “So, a flaw in a website’s software can end with stolen customer data, or a hospital, school, or retailer locked out of its own systems — often months later.”A successful attack on a vulnerable website could allow the attackers to steal your personal account information, such as login credentials, contact information, shipping addresses, credit card numbers, and more. This information could be used immediately, such as with credit card fraud, or used to stage more complex phishing attacks or identity theft later on.“A compromised site could also be used to deceive visitors or infect their devices,” Fistonish said.Practice good security hygiene. You don’t need to go out and change all of your passwords or stop using websites. Taking the same security measures we always recommend will go a long way toward keeping you safe online. Make sure that you’re using a unique and complex password for each and every online account and that you’re saving your passwords in a password manager. Enable two-factor authentication wherever it’s available. Also, confirm that all your devices are set up to receive automatic updates for your operating system and apps, and make sure to actually run those updates.“Be especially cautious of emails claiming a company has had a data breach and is asking you to click a link, as scammers often take advantage of breaking news like this to target you,” Fistonish said.This security flaw demonstrates how the invisible infrastructure of the web could be vulnerable to attack.“PHP is part of the open-source foundation which trillion-dollar companies have built their businesses on. But because it is open source, maintenance of these critical systems depends on a small number of volunteers working on this in their free time,” said Quintin, who called for more investment in open-source projects.This article was edited by Caitlin McGarry and Jason Chen.Further reading
Source link