Russia-based security researcher Emil 'Neex Lerner has disclosed a remote-code execution vulnerability in PHP 7 – the newest iteration of the massively widespread net growth language used by hackers.
PHP is a server side scripting language that is used to develop static websites, dynamic websites or web applications. It forms the basis of popular content management systems like WordPress, Drupal, as well as Facebook (kinda). Due to this, it is a huge deal whenever someone wants to identify a security vulnerability within it.
With this vulnerability, which has the CVE-ID of 2019-11043, an attacker may drive a distant net server to execute their very own arbitrary code just by accessing a crafted URL. The attacker only needs to add "?a=" to the website address, followed by their payload, The Next Web (TNW) reported on Sunday.
The hackers "exploited flaws on at least three of the organisation's chapter websites – which we're not naming – and downloaded the contents of each web server," the report said. Pixabay
As per the report, this attack drastically lowers the barrier to entry for hacking a website which even a non-technical user could abuse.
The vulnerability only impacts servers using the NGINX web server with the PHP-FPM extension and users who are unable to update their PHP install can mitigate the problem by setting a rule within the standard PHP ModSecurity firewall. (IANS)