Federal officials are racing to address the flaws as security researchers work to determine whether hackers have successfully exploited them. JuSun/Getty Images
Federal agencies have until Thursday to fix website security flaws
The vulnerabilities could let hackers take control of government web servers without a password, but the extent of successful attacks remains unclear.
Federal civilian agencies have until Thursday to address two critical PHP vulnerabilities that CISA has now warned are being exploited by hackers, escalating the government’s response to flaws in software used to operate websites worldwide.
The Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities catalog Monday, setting an Oct. 29 remediation deadline. The designation marks a change from CISA’s initial warning last week, when the agency said it had not observed exploitation. The catalog entries do not identify victims or describe the evidence behind the decision, leaving the scale of successful attacks unclear.
Known collectively as PHP2Shell, the vulnerabilities can allow hackers to run commands on a web server without an account or password, potentially enabling them to steal data or alter a website.
PHP handles tasks such as processing forms and retrieving information for websites built with WordPress, Drupal and other platforms. Because the defects are in PHP itself, a website can be exposed even if its own code and plugins are up to date.
The federal action follows several days of attempted hacks, alongside conflicting assessments of whether those attempts worked. Cloudflare reported millions of attempts last week.
Two security companies have since corrected earlier findings about the vulnerabilities. Sophos said its initial report of successful exploitation instead reflected scanning and failed attempts. Palo Alto Networks’ Unit 42 said Sunday that it could not confirm PHP2Shell was the entry point in an attack against a European government agency, retracting an earlier assessment.
The extent of federal exposure also remains uncertain. A Nextgov/FCW review last week found roughly 900 Shodan search results associated with federal, state and local government websites that showed signs of PHP use, though many of those PHP builds may have already been updated or were up-to-date prior to the vulnerabilities becoming public.
Repairs are progressing globally. Censys’ PHP2Shell tracker listed more than 10 million services as patched since Oct. 21. PHP’s developers released fixes last week.
CISA has urged organizations to locate PHP across their systems, including where it is embedded in other software, and prioritize internet-facing installations. Systems that can’t be promptly updated should be taken offline, according to its alert.