On 21st October, the NCSC issued an alert urging UK organisations to take immediate action on a critical security issue affecting PHP, the widely used server-side scripting language that powers dynamic websites, database interactions and back-end applications, and which is also built into a range of other products.
PHP has published a security update fixing two vulnerabilities, which could allow an attacker to trigger an out-of-memory condition that corrupts memory and, under certain conditions, to execute code remotely on any web server running PHP without needing to log in.
The NCSC warns that every version of PHP is affected, so organisations should not limit their checks to older installations. The NCSC also stresses that PHP is often bundled into third-party appliances and services, so organisations should watch for updates from those vendors too.
NCSC-NL has published an inventory of software products with a PHP dependency that may be affected. UK organisations can also sign up to the free NCSC Early Warning service to be notified of potential threats on their networks.