CISA confirmed active exploitation of two serious PHP security flaws allowing remote system access without passwords.
Following developer patches, U.S. civilian agencies were ordered to fix systems within three days, highlighting ongoing maintenance challenges in widely used web infrastructure.
How the problem was discovered
The two flaws had been in the software for years, but the team that maintains it considered them harmless because they believed they were too difficult to exploit in practice. Earlier this year, however, researchers from security firm Calif managed to find a way to exploit them using an artificial intelligence program. The software's creators released fixes just days before CISA's official warning.
Why problems are dangerous
The vulnerabilities allow unknown parties to remotely access vulnerable systems over the internet, without requiring a password. It is estimated that this technology is used on about 70% of the servers that host websites worldwide, putting critical applications and large web systems at risk. The issue also highlights that many older internet technologies rely on limited resources and funding.
CISA did not say who was carrying out the attacks, but its warning came after evidence gathered by researchers showed that the attacks were already taking place.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
end of article
Top comments (0)