The Cybercrime Investigation and Coordinating Center (CICC) has warned website operators, businesses, and government agencies about two critical security vulnerabilities in PHP that could allow cybercriminals to gain unauthorized access to servers and execute malicious code.
In a cybersecurity advisory, the CICC said the vulnerabilities, referred to as PHP2Shell, could affect websites and web applications running vulnerable versions of PHP, a programming language widely used in developing online platforms and services.
According to the agency, attackers could exploit the flaws to execute malicious commands on affected servers without requiring login credentials.
The vulnerabilities could also lead to website or system takeovers, allowing attackers to modify data, access sensitive information, or use compromised servers to launch additional cyberattacks.
Other potential consequences include service disruptions, exposure of confidential information stored in server memory, and the execution of harmful code that could further compromise affected systems.
The CICC identified government websites, online public services, businesses relying on PHP-powered platforms, and servers using vulnerable configurations as among those potentially at risk.
Systems running Apache with the PHP module were also identified as requiring particular attention.
To reduce exposure, the agency urged website administrators and organizations to immediately identify systems running PHP, including third-party applications, and install the appropriate security patches or upgrade to fixed versions.
It also recommended maintaining secure and updated backups of databases and critical files to prevent potential data loss.
For systems that cannot be patched immediately, the CICC advised administrators to temporarily restrict public access to vulnerable internet-facing services until the necessary security measures are implemented.
Organizations were also encouraged to review system logs for unusual activity, suspicious commands, unexpected files, and unauthorized connections that could indicate a possible compromise.
The agency further recommended conducting vulnerability assessments to determine whether affected systems remain exposed after security updates.
Website operators were advised to coordinate with their IT teams or hosting providers to ensure that PHP installations and related applications are properly secured.
