Kazakhstan's National Computer Incident Response Service KZ-CERT has issued an emergency warning for Kazakh administrators and owners of web resources. Two critical vulnerabilities under the common name PHP2Shell have been discovered in the popular PHP programming language, which powers the vast majority of websites in the country. They allow cybercriminals to remotely seize control of servers without entering passwords. This was reported by Qazaqyia.kz citing Kursiv Media.

Highest severity score

Both vulnerabilities received the highest severity rating — 9.2 points on the international CVSS scale. The problem lies in memory management errors within the PHP core itself, some of which have been present in the code since 2012.

An attacker only needs to send a specially crafted HTTP request to a website to trigger a memory failure on the server. As a result, hackers gain the ability to execute arbitrary code and steal confidential data directly from working memory, including passwords, API keys and session tokens.

Which platforms are at risk

The vulnerability affects almost all popular platforms and CMSs on which Kazakh news portals, online stores, corporate websites and government services are based. Resources on WordPress, Laravel, 1C-Bitrix, Magento, Drupal, Joomla, Symfony, Nextcloud and phpMyAdmin are at risk.

Experts emphasize that fixing the code of the website or web application itself will not protect against hacking, since the gap is located in the server engine itself.

«Since the vulnerabilities are located directly in the PHP core, modifying the source code of the web application does not ensure their complete elimination. Protection requires updating the server environment,» KZ-CERT warned.

Patches already released

PHP developers have already released emergency security patches. To completely eliminate the threat, specialists and system administrators must immediately update PHP to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and then обязательно restart the web server worker processes.

As temporary measures before installing the patches, experts recommend disabling file upload progress tracking, limiting the size of incoming requests and strengthening monitoring of suspicious activity in logs. However, experts warn that temporarily introduced settings only reduce risks but do not replace a full system update.

Read also: Hackers found a way to steal websites worldwide: «Kursiv» updates its protection.