Expert calls PHP flaw the most dangerous vulnerability he remembers

A vulnerability in PHP software that prompted the temporary shutdown of several Latvian government and municipal websites is the most dangerous internet flaw he can recall, cybersecurity expert Kirils Solovjovs told Latvian Television’s Rīta Panorāma, LSM reported.

The flaw could let attackers change website content, run commands and launch unauthorised programs on almost any web server. “The simplest way to put it is that someone exploiting the vulnerability could become the site’s owner,” Solovjovs said.

He said the software is used by about 70% of web servers worldwide. Solovjovs compared the flaw with a global vulnerability discovered in 2014, which allowed attackers to access what internet users saw on their screens. “This vulnerability allows the same things and more,” he said.

Solovjovs welcomed the swift response to the risk but warned that many websites in the private sector could still be vulnerable. He said flaws of this severity are discovered about once every 10 years.

The vulnerability has existed since March 1, 2012, he said. Solovjovs added that a warning was issued on October 20 that patches would need to be applied, giving defenders time to prepare.