Critical PHP flaw could affect Andorran websites and online services

Andorra’s National Cybersecurity Agency (ANC-AD), through its incident response team CSIRT-AD, has warned of two critical PHP vulnerabilities that could allow an attacker to access a web server remotely and take control of it without credentials.

ANA reports that the flaws, commonly known as PHP2Shell, are already being targeted in attempted exploits.

PHP underpins numerous websites, content management systems and online shops. Systems that may use it include WordPress, Joomla, Drupal, PrestaShop, WooCommerce and Magento, as well as intranets, client portals and custom-built management applications.

Security patches have been released

Details of the vulnerabilities emerged before security updates were published. The PHP development team released patched versions on Wednesday, while international cybersecurity firms had already detected attempted exploits.

The vulnerabilities may affect any PHP installation serving web pages, regardless of its configuration. The alert says the risk extends to all versions from PHP 5 onwards.

PHP 8.1 and earlier no longer receive official updates from the PHP project, leaving older systems more exposed.

Alert affects service providers and their customers

The ANC-AD says the potential impact could be particularly significant for small and medium-sized businesses. Many shops have PHP-based websites managed by external providers or hosted on shared services. In those cases, businesses may not have direct access to information about which PHP version is installed.

For larger organisations, the risk could affect client portals, internal applications accessible from the internet and third-party platforms that could provide a way into corporate networks.

Web-hosting, managed-service and development providers also have a key role: a single vulnerable platform could affect several customers at once.

The agency, which is monitoring the incident with international organisations, is urging organisations in Andorra to apply the security patches immediately. According to the ANC-AD, updating systems is the most effective protection against these vulnerabilities.