Critical vulnerabilities discovered impacting popular programming language for websites

Two critical vulnerabilities have been discovered in Hypertext Preprocessor, or PHP, a widely-used open-source scripted language for web development, its creators announced today. The vulnerabilities reportedly impact a majority of the world's websites. The two issues can allow unauthenticated remote code execution. The notice advises all PHP users to download updates immediately, as all PHP installations serving web requests are at risk. The National Security Agency advised organizations to take their systems offline if an immediate update is not feasible, and that the agency will soon issue specific guidance. An AHA Cybersecurity Advisory released today provides additional details and recommendations.

For more information on this or other cyber and risk issues, contact John Riggi, AHA national advisor for cybersecurity and risk, at [email protected], or Scott Gee, AHA deputy national advisor for cybersecurity and risk, at [email protected]. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.