Government Websites Go Dark After Severe PHP Vulnerabilities Disclosed (the-independent.com) 58
"PHP disclosed two critical vulnerabilities in their programming language and urged web site operators to immediately apply the fix," writes longtime Slashdot reader smooth wombat. "As a result, government web sites in Europe and elsewhere temporarily went dark on Wednesday as operators worked to protect their systems." The Independent reports: Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare, said that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure. "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update," he said on X.
Officials have said that all PHP versions from PHP 5 onward could be affected, although PHP has not yet disclosed which versions are vulnerable. Special thanks to Slashdot readers Alain Williams and mrspoonsi for sharing this critical PHP security release.
For more details, read the official PHP announcement and guidance on what to do next.
Officials have said that all PHP versions from PHP 5 onward could be affected, although PHP has not yet disclosed which versions are vulnerable. Special thanks to Slashdot readers Alain Williams and mrspoonsi for sharing this critical PHP security release.
For more details, read the official PHP announcement and guidance on what to do next.
Get Well Soon (Score:5, Funny)
Re: (Score:2)
Re:Get Well Soon (Score:5, Insightful)
Re: (Score:2)
Guess you'll be opting out of social security then?
What Social Security? (Score:2)
If I could opt out now and stop paying into it yes please!
Not like there will be anything to opt out of once I am eligible.
Ponzi schemes are bad, eventually you run out of new investors stupid enough to throw money in.
Re: What Social Security? (Score:2)
Social security would be fine without the contribution cap
Delaying the inevitable (Score:1)
Social Security is fundamentally flawed, like all Ponzi Schemes; throwing more money at it will only delay the inevitable.
You will simply want more and more to prop up a broken scheme.
Re: Delaying the inevitable (Score:2)
Welcome to capitalism, which can't work without endless growth, like any tumor.
Re: You Spelt Socialism Wrong (Score:2)
It's nice you had just enough self awareness to write seemingly, since on some level you know it's impossible.
Too bad you weren't able to take the next step and see that greed is the problem, not helping some people meet their needs.
Re: (Score:2)
It makes me laugh when Americans whine about being Free from their Governments but are perfectly happy being Slaves to their Corporations, barely a week off laboring a year, call ins on Saturdays - where is this Freedom? I guess you are Free to choose to work your entire life away or Free to wander the cities homeless hungry and cold
Re: You Spelt Socialism Wrong (Score:2)
That's a truly empty headed view as nobody is getting rich on social security. What a cuck you are to be glad to watch the billionaires rape our economy.
Fear of a Finite Universe (Score:2)
"Endless growth" is your delusion, not mine. But we have hardly exhausted what this universe has to offer for our expansion. I would expect any economic structure to fail if it does not find a steady state. So far socialism has shown itself to fail first on multiple occasions and only survives with a capitalist's "investment"; see your beloved Social Security for instance that depends on the earnings of the very economy you are condemning.
I have seen firsthand how government “help” can keep peop
Re: You Spelt Socialism Wrong (Score:2)
Yes it does you fucking idiot.
Re: Fear of a Finite Universe (Score:2)
Where do you volunteer that gets zero government funding?
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
I'm sure he volunteered once for a weekend five years ago, and he's completely wrong about the funding.
Re: (Score:2)
Americans are not free from their Governments.
Perhaps more free than most in other countries, but tyranny still abounds from all parties in rule; and seemingly getting worse.
Americans are not slaves to their corporations as you point out later, they are not owned by the corporation, free to leave, and compensated for their labor; all freedoms a slave does not have.
It is a false dichotomy to imply that an American's choice is to work their entire life away or wonder homeless, hungry, and cold.
The abundance a
Re: (Score:2)
It is not a Ponzi scheme and never was, where did you get that dumb idea? What you are whining about is the decrease in youngins paying into the system. It seems Americans are not fucking like they used to and a good number of them somehow think that immigrant dogs and cats are coming here and eating the native population.....errrr.....well, it is something like that.....I recall words to that effect in the last election.....or maybe it is because boys are going to school and coming home as girls. These and
Re: (Score:3)
A Ponzi scheme is a fraudulent investment scam that pays "profits" to older investors using the capital collected from newer investors rather than actual business earnings.
Social Security pays older investors with new investors capital and has no actual business earnings.
Social Security is 100% a Ponzi Scheme.
But semantics are semantics, who cares what we call it?
You just do not like calling it a Ponzi Scheme because Ponzi Schemes are frowned upon for producing not earnings and are unsustainable.
Well at lea
Re: (Score:3)
I see, so GrandMa and GrandPa can come and live with you, yes? You have room. And no sneaky asking for their Medicare, no gov. assistance for you.
BTW: Their meds are very expensive, so save your pennies.
Re: (Score:2)
Yes I love having my parents close, free baby sitters who would pay for the privilege.
Fortunately they also took good care of themselves and are not popping expensive patent encumbered pharmaceuticals.
In addition they invested wisely and saved to cover their expenses for retirement.
They did well to support multiple children who are very successful and more than capable of returning the favor of caring for them in their old age.
It is a blessing.
It is sad to watch families who will not take each other in, nor
Re: (Score:2)
A large number of sites are down. Among more /. crowd would be GoG and Steam for the same reason.
The only really good news is a lot of people are taking it seriously still and not just leaving something vulnerable up. Hopefully sites remaining down will alert others to update their PHP.
For more details.... (Score:3, Informative)
Read the prior story that was posted to the front page just prior to this one.
Good jorb, editors. In a crazy world like we're living in now, it's reassuring to know that some things like slashdot editors not reading the site will never change.
Re:For more details.... (Score:5, Informative)
The very first link in this submission links to the previous story. It's a followup to it, not the exact same story.
Re: (Score:2)
The editor would of been better off editing the original post with additional links on the bottom of it. We could use the word "update" in front of it, maybe something like
**Update**
Just spitballing here really. Maybe that would work though.
Re:For more details.... (Score:5, Funny)
Re: (Score:2)
Well played
Re: (Score:2)
If you were qualified to be an editor you would check your sig for a possessive usage and manage the sig character limit more effectively. ;-)
Re: For more details.... (Score:2)
Re: (Score:2)
Re: For more details.... (Score:2)
Maybe they have been. It would explain a lot.
Re: (Score:2)
Only if it happened a decade or two ago.
Re: Bots running Slashdot? (Score:1)
DupeGPT?
According to the notes, it isn't in the wild (Score:3)
The patch notes say both vulnerabilities will be fixed on Oct 26 unless it's seen in the wild before that.
I've had trust issues with PHP using software since one piece I installed wanted to run web files root. Just no. Web server files are owned by the web user and can't touch anything else on the Raspberry Pi it runs on. That is not PHP though, just developers that don't think of security first using PHP.
Re: (Score:3)
Having Web server files owned by the web user is a security risk; if someone executes code as the web user, they can change those files.
If the files are owned by root, then they can't be defaced by the web user.
If you need to have writable files, then those should be in a separate directory that's not part of the WEBROOT.
Re: According to the notes, it isn't in the wild (Score:2)
Re: According to the notes, it isn't in the wild (Score:2)
Most sites don't store code in the db.
Drupal used to let you do that but they took it out for security reasons.
It's a much bigger deal if they can write PHP files and then run them, because that allows them to execute arbitrary code as the Web user.
Re: (Score:2)
I never said that having web files not owned by the web user makes your site secure. I just said that it's not a good idea to have files in the WEBROOT that are writable by the web user because that makes defacing a site or even running malware in clients' web browsers trivial.
My personal web site uses PHP, but I don't use a database because the site is simple enough not to require one. I use PHP more-or-less as a templating engine to include standard boilerplate headers and footers on all of the pages.
Re: (Score:2)
Before your code even runs (Score:5, Interesting)
The detail that jumps out in PHP's advisory [php.net] is that the demonstrated mod_php exploit can trigger before any application code runs. Your application's login screen and carefully written input validation never get a vote. Under those circumstances, a PHP-generated "down for maintenance" page could still leave you exposed. Taking a site offline while sorting that out seems entirely reasonable. An outage is visible and embarrassing, which makes it easy to criticize. A compromised server might keep serving perfectly normal pages while somebody helps themselves to the data. The fixed releases are now available. What I'd want to hear afterward is how quickly each organization could identify its PHP installations and get the fixes deployed. If answering "where do we run this?" requires an emergency meeting and somebody's old spreadsheet, there's another problem waiting for the next advisory.
Re: (Score:1)
Re: (Score:1)
What's clearly better and doesn't rely on Security Thru Obscurity?
Drupal (Score:2)
Over 50% of the world's public government websites are hosted on Drupal, which is based on PHP.
Re: (Score:2)
Re: Drupal (Score:2)
The claim that drupal powers 56% of government websites is repeated on a few sites. It seems to be from 2021. It doesn't have a credible source and seems to be false.
Japan personal data leaks (Score:2)
There has been an increase in reports of cyber attacks resulting in the leaking of customers' personal data here in Japan, just over the last month or so.
The use of AI to both identify vulnerabilities and exploit them is presumably a period we need to go through, albeit painful. We come out the other side with more robust software.
It's a bit like if all the world were suddenly compelled to go for a health check... with the addition of bad guys who go around infecting people that are now known to have weak i
nightmare (Score:2)
Re: nightmare (Score:2)
Wordpress being insecure has been a proven fact for a long time. But this PHP issue is something a bit more fundamental.