According to Krebs on Security, nearly 70 percent of websites require updating their core software to address two vulnerabilities that permit an attacker to gain full control of affected servers. These flaws have working exploits available, and the bugs are already being used in real-world attacks today.
The issues affect PHP implementations widely deployed on web servers. Sites that do not apply updates may experience disruptions such as serving “404” or “Page Not Found” errors to visitors. The vulnerabilities allow remote code execution leading to complete server takeover when exploited.
Security professionals have confirmed the existence of functional exploits circulating, and observed deployments indicate the flaws are currently in use by attackers against vulnerable systems. Immediate patching is recommended for affected installations to prevent service interruptions and unauthorized access.
