On Wednesday the 21st of October, Many Government websites and site owners went dark in order to patch severely concerning flaws Open AI exposed to the public.
PHP had two critical errors after publishing a service update that allowed anyone to run code on your server without being able to log in. This detail was then leaked before the patch for this bug was even out.
This bug affected around 70% of websites on the web being ran on PHP, including as WordPress, MediaWiki, and many other servers that affected thousands of different tools, including Government websites all over the world, Council Websites, Gaming Online Servers, and many other tools on the internet.
Many TLS certificates, including an Indian certificate authority eMudhra, was found to have keys so weak that they were basically wide open and free for the taking. This allows bad access to easily forge those keys, impersonate legitimate domains like banks, email providers and more. A lot of keys on that website were exposed, as the company used generic passkeys, easily accessible to the general public.
There are a few things you can do to get your tools working again, as recommended by the National Cyber Security Centre – https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php. Organisations should follow these priority actions:
- Identify systems running PHP across your infrastructure, prioritising internet-facing systems. As all versions may be affected, do not limit discovery to outdated PHP versions; identify PHP installations generally and assess their exposure to CVE-2026-109618 and CVE-2026-109619.
- Update to the latest version of PHP and continue to monitor for future updates.
- If you are unable to update to a version with the security update applied, the PHP Foundation has provided temporary mitigations.
- If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.
- If you are unable to update or disable the system immediately then you should assess the system for any evidence of compromise prior to your upgrade or mitigation and look for backdoors installed by an attacker. If you are not confident in your ability to do this yourselves then you can get assistance from an NCSC-assured Cyber Incident Response provider.
- Continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP. NCSC-NL have published an inventory list of software products with a PHP dependency potentially affected by the vulnerabilities. Apply relevant updates as they become available.
| [donate]
| Help keep news FREE for our readersSupporting your local community newspaper/online news outlet is crucial now more than ever. If you believe in independent journalism,then consider making a valuable contribution by making a one-time or monthly donation. We operate in rural areas where providing unbiased news can be challenging. |
