Canindia News

Hackers using bug in PHP7 to hijack web servers: Report

Moscow, Oct 28 (IANS) Russia-based security researcher Emil ‘Neex Lerner has disclosed a remote-code execution vulnerability in PHP 7 – the newest iteration of the massively widespread net growth language.

PHP is a server side scripting language that is used to develop static websites, dynamic websites or web applications. It forms the basis of popular content management systems like WordPress, Drupal, as well as Facebook (kinda). Due to this, it is a huge deal whenever someone wants to identify a security vulnerability within it.

With this vulnerability, which has the CVE-ID of 2019-11043, an attacker may drive a distant net server to execute their very own arbitrary code just by accessing a crafted URL. The attacker only needs to add “?a=” to the website address, followed by their payload, The Next Web (TNW) reported on Sunday.

As per the report, this attack drastically lowers the barrier to entry for hacking a website which even a non-technical user could abuse.

The vulnerability only impacts servers using the NGINX web server with the PHP-FPM extension and users who are unable to update their PHP install can mitigate the problem by setting a rule within the standard PHP ModSecurity firewall.




Gold can be mined from vermicast in Goan mining belt, claims report

Pak complied with 36 of 40 FATF parameters: APG report

Mueller report: US Congress to get redacted version by ‘mid April’

Leave a Comment

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More