Researcher Warns PHP Exploits Are Circulating Before Critical Patch Release

Exploits reported before PHP patches arrive

A security researcher known as Bürgel says exploits targeting PHP are already circulating, according to a report from The Defiant. PHP is a widely used programming language that powers many websites and web applications.

The report says fixes for PHP are scheduled for 10 a.m. ET. Security advisories are telling operators to limit services that are exposed and to be ready to patch as soon as the fixes are released.

What the advisories tell operators

• Exploits are said to be in circulation before the patches are available.
• The PHP fixes are scheduled for 10 a.m. ET.
• Operators are urged to restrict exposed services.
• Operators are told to prepare to patch immediately once the fixes are out.

What is confirmed

The Defiant reports that the patches are scheduled for 10 a.m. ET and that security advisories call on operators to restrict exposed services and patch right away.

What is still unclear

The circulating exploits are described as a claim from Bürgel. The supplied material does not say which versions of PHP are affected, how the exploits work, who is behind them, or whether any systems have already been compromised. The material also does not name the vendors or groups that issued the advisories.

Why it matters

Many websites and online services run on PHP. If attackers can use flaws in it before fixes are installed, the operators of those systems need to know that patching quickly and cutting off exposed access may reduce the risk. The supplied material does not give further detail on the scale or impact of the issue.

Sources

• The Defiant