FSB demands temporary closure of PHP sites with unpatched vulnerabilities

The FSB’s cybersecurity unit demanded that critical information infrastructure operators temporarily close websites if they cannot immediately fix critical PHP vulnerabilities. The requirement applies to government agencies and the communications, financial, energy, transport and healthcare sectors.

The FSB’s cybersecurity unit demanded that operators of critical infrastructure temporarily close their websites if they cannot immediately fix critical vulnerabilities in the PHP programming language. Artificial intelligence was used to identify the vulnerabilities. Operators were instructed to urgently install updates, conduct a full antivirus scan and report suspicious activity.

The warning calls for temporarily restricting external access to vulnerable web servers and, if necessary, shutting them down completely. The requirement applies to communications networks and government information systems, as well as companies in the financial, energy, transport, healthcare and other sectors. PHP developers released a fix on Wednesday.

Здание на Лубянской площади в Москве

The FSB’s approach echoes similar warnings from the U.S. National Security Agency and relevant agencies in the EU and China. Cloud companies Cloudflare and Amazon said the number of cyberattack attempts had risen to millions after the vulnerabilities were disclosed.

According to W3Techs, PHP is used by more than 90% of Russian-language websites and around 70% of websites worldwide. Specialists estimate that tens or hundreds of thousands of websites in Russia could therefore be vulnerable.