Two critical security flaws in PHP, known together as PHP2Shell, can let an attacker take control of a web server without a password. PHP is the programming language behind about 70% of websites whose technology can be identified, including sites built on WordPress, Drupal and Joomla.
A fix has been available since 1am AEDT on Thursday 22 October. The Essential Eight, the Australian Government's baseline for cyber security, expects critical flaws in internet-facing services to be fixed within 48 hours of a fix being released.
Our Chief Information Security Officer, Charles Mann, has published an advisory that explains which versions are fixed, how to check your websites, and what to do if a system cannot be updated. We are keeping it updated as the situation changes.
Read more briefings in the Cyber Brief.
