Two critical PHP flaws disclosed this week let attackers take over a web server without logging in. Amazon says attackers were probing for them before patches existed and that the flaws are now “broadly exploited in the wild.” The Guardian reports millions of attempts against websites worldwide, and some governments and companies have pulled sites offline to patch.
Why it matters: PHP runs a large share of business websites, including most WordPress sites. If your site is on PHP, it is a target right now.
One step today: ask your web host or developer to confirm you are on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. CISA says anything on PHP 8.1 or older should come offline until it is updated.
Not sure what your site runs on? We will check it. Call (818) 791-0055 or visit contact VanquishNet.
Sources: CISA, SecurityWeek, The Guardian.