The National Coordination Center for Computer Incidents (NCCC) under the FSB has issued a directive to critical information infrastructure entities in Russia. Organizations are required to update PHP to the latest version, scan servers for malware, and analyze event logs for signs of unauthorized access.
The directive follows the discovery of two critical vulnerabilities in PHP, which received a severity score of 9.2 out of 10. These flaws allow remote attackers to gain control over servers and extract sensitive data, such as passwords and cryptographic keys. One of the vulnerabilities was identified using artificial intelligence.
If immediate patching is not possible, the NCCC recommends restricting external access to web servers or shutting them down entirely. Organizations must report any suspicious incidents to the State System for Detection, Prevention and Elimination of Consequences of Computer Attacks (GosSOPKA).
The scope of the potential threat is significant, as PHP powers 90.8% of Russian-language websites and 69.3% of all websites globally. Updating content management systems like WordPress, Drupal, or Joomla does not resolve the issue, as the vulnerabilities reside within the PHP core itself.
