LUCAMETwo serious security vulnerabilities, collectively nicknamed 'php2shell', have been disclosed in PHP, the software that powers a large proportion of websites worldwide. Both flaws allow an attacker to run arbitrary code on an affected server without needing any login credentials. Every common way of running PHP is affected, including the configurations used by most web hosting environments. The US cybersecurity agency CISA is urging all organisations to apply patches without delay.
What this means for your business
If your website or any internal web application runs on PHP and has not been updated, an attacker could potentially take full control of that server and everything on it, including client data, emails and documents. Your IT provider should update PHP to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as a matter of urgency. If you are unsure whether PHP is in use on your systems, contact Lucame and we will check for you.