Washington D.C. — Bugs in popular coding languages could leave sites, including US government sites, vulnerable to attack, the National Security Agency warns.
In a statement Wednesday, the PHP Foundation, an organization that promotes a programming language used to build many websites, warned site owners to update their code immediately or take their sites offline.
According to the foundation, researchers identified two vulnerabilities in how PHP manages information stored in a server’s memory. The National Security Agency said Wednesday these vulnerabilities could extend to websites important to the U.S. government.
One issue can occur when the system runs out of memory while processing a request, while the other can allow information from an earlier request to remain after it should have been cleared.
Both flaws could allow an attacker to run code on the server without logging into the site directly.
In an advisory, the foundation urged users to update their code or take their sites offline to protect user data.
The PHP Foundation provided the following instructions for updating their code:
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Source downloads are on our downloads page. Windows source and binaries are on the same page.
- Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages.
- PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.
- Given the severity of these vulnerabilities, the PHP security team provided minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.
The NSA said it is working with intelligence agencies to investigate the incident.