PHP Under Attack | This Week’s Security Breaches Explained

The PHP security team has issued an emergency warning. Two critical flaws are due to be patched at midnight tonight, Brisbane time, but the affected versions and attack conditions haven’t been published yet. Today, we also have compromised HTTPS certificates, a cloud software supply chain attack, new WordPress backdoor findings and a migration plugin flaw.

Hi, I’m Dustin Gray. I’ve been building production software for 25 years, and I look at the security stories that matter today.

First, a warning for anybody responsible for a PHP website. The PHP security team is preparing fixes for two critical vulnerabilities. Both are rated 9.2 under the latest scoring system, and the release is scheduled for midnight tonight in Brisbane.

But here’s the important distinction. The team hasn’t yet published the affected versions or exploitation conditions. Researchers have raised concerns about remote code execution, but active exploitation hasn’t been confirmed, so don’t assume every PHP website can already be taken over.

So today, ask your host which PHP versions your website uses. Prepare a tested backup and a maintenance window, and confirm who will install and verify the fixes when they arrive. The question today isn’t whether you’ve patched, it’s whether you’re ready when the patch drops.

Next up, the security behind the padlock in your browser. Mozilla has confirmed that private keys for eight certificates were compromised. Those certificates help prove a website is genuine, but someone holding the keys could potentially impersonate a website they don’t own, although they would still need to intercept the connection.

Browser vendors quickly blocked the affected certificates, and most normally configured Firefox users were protected on Saturday. Yesterday, Mozilla released extra protection for systems that might miss the automatic block. There’s no confirmed evidence of forged certificates being used in attacks yet.

So ask your team to check browsers and automated applications that validate HTTPS connections. Make sure the certificate trust protections are current, because a padlock is only as trustworthy as the authority behind it.

Now, an important update to the UpdraftCentral attack we covered yesterday. Researchers identified three kinds of malicious plugins installed using stolen WordPress management keys, and two can hide from the normal WordPress screens. That changes how you need to investigate.

Imunify360 says its scanner now detects the backdoors it identified. The corrected UpdraftPlus releases also revoke older cloud keys: that’s 1.26.13 for free users and 2.26.13 for premium. And again, this attack concerns sites connected to UpdraftCentral Cloud, so not every UpdraftPlus installation was compromised.

So today, make sure you update, revoke old keys, and inspect plugin files and user accounts directly. Don’t rely only on the dashboard. If you find a backdoor, investigate and recover the site as compromised, because removing a visible plugin may not remove the access it created.

Next up, an official cloud management download was replaced with malware. An attacker hijacked a contributor’s GitHub account and swapped files on five OVHcloud software releases. The malicious downloads were available for about 94 minutes on Monday.

But here’s the surprise. The source code and build pipeline weren’t changed; the attacker replaced files attached to existing releases, and new analysis shows the published checksum file was replaced too. So comparing a download against that same page wasn’t an independent check.

Exposure required downloading or updating during the affected window, and OVHcloud has released a clean version 0.16.0. If your team installed the tool during that window, investigate the machine, rotate potentially exposed cloud and deployment credentials, and review access to connected services. Replacing malicious software doesn’t revoke secrets already copied.

And finally, a new investigation into Duplicator, which is used on more than a million WordPress sites. This vulnerability has an unusual trigger: an attacker without an account could leave malicious data in an ordinary comment. Nothing necessarily happens at first, and the danger comes later.

If an administrator includes that comment in a Duplicator package and runs a standard migration using an affected installer, the data can become dangerous. Researchers demonstrated server command execution in the free edition. The Pro edition has a different path that can lead to takeover under additional conditions.

Version 5.0.0 fixed the flaw in September, but yesterday’s disclosure explains why updating may not be enough: old migration packages keep their original installers. Today’s action is to update Duplicator, rebuild old packages before using them for migrations where practical, and remove unnecessary public installer files.

Here’s the common lesson. Website security extends beyond the website itself. It includes the language underneath it, the certificates providing identity, the software your developers download, the management keys you trust and the installers you use to recover.

Each one crosses a trust boundary, and a system can work perfectly while that boundary fails. That’s the difference between “it works” and “it’s secure and production ready”. So here’s what you need to look at today: which part of your website’s trust chain have you never actually verified?