WELLINGTON, Oct. 22 (Xinhua) -- New Zealand's National Cyber Security Center (NCSC) on Thursday urged organizations to immediately apply security patches against critical vulnerabilities in PHP, a programming language widely used in websites and web services.
The vulnerabilities could allow attackers to take full control of a website, web server or web service, including defacing or taking down websites, the NCSC said in a statement.
A patch was released by the PHP Foundation, which is responsible for the programming language, at 3 a.m. local time on Thursday. The NCSC said the update would protect underlying systems that rely on the PHP programming language, but further updates from software and web service providers might be required.
Older, end-of-life versions of PHP would remain vulnerable unless organizations apply custom patches or receive updates through enterprise operating system vendors, it said.
The NCSC advised organizations and individuals to monitor official PHP guidance and apply security patches as they become available and actively monitor for exploitation. Patching the exposed services will not remove already exploited systems.
Organizations unable to patch immediately should consider disabling public-facing web services, while checking with third-party suppliers to determine whether their systems use PHP and need to address these vulnerabilities, the agency said. ■