Dear Community Partners,
The Community Security Initiative (CSI) is sharing information about recently discovered critical cybersecurity vulnerabilities affecting PHP, a technology widely used to operate websites and online applications, including those used by synagogues, schools, and nonprofit organizations. Below is an overview of the vulnerabilities, why they matter, and recommended actions to protect your institution.
What are the vulnerabilities, and why do they matter?
PHP is software that works behind the scenes to power websites, including features such as event registration, membership portals, and online forms.
Two recently discovered vulnerabilities, collectively known as PHP2Shell, could allow hackers to gain unauthorized control of vulnerable website servers without needing a password.
If successfully exploited, attackers could potentially:
- Steal sensitive information, including member, donor, employee, or student data.
- Take over or alter websites, including posting malicious content or redirecting visitors to fraudulent pages.
- Disrupt operations by disabling websites or associated services.
- Compromise additional systems connected to the affected server.
What should your organization do?
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the PHP Security Team have issued guidance recommending the following actions:
- Identify affected systems: Contact your IT provider or website hosting company and ask whether your organization’s websites or online applications use PHP. If so, ask whether they are affected by these vulnerabilities and whether the necessary security updates have been installed.
- Immediately apply security updates: Ensure affected systems are updated to secure PHP versions. Official patching guidance is available on the PHP website.
- Mitigate exposure: If affected systems cannot be patched immediately, take them offline until appropriately secured, consistent with FBI guidance.
- Monitor for potential exploitation: Ask your IT provider to review relevant logs for suspicious activity, including unexpected PHP processes executing commands, launching shells, or downloading tools.
Additional information:
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching
- FBI: Critical Vulnerability Alert — PHP Core
- Official PHP Security Advisory
If you believe your institution may have experienced a related security incident, please contact your IT provider and coordinate with your CSI Regional Security Director.
Best regards,
Community Security Initiative (CSI)
Cybersecurity Program
To schedule a Security Assessment and/or Training for your institution in New York City, Long Island, Westchester, Rockland, the Greater Hudson Valley, Western New York (Buffalo, Erie & Niagara Counties), or Southwest Connecticut, please click the link below:
Service Requests – Community Security Initiative (csiny.org)
or contact us at: csi_questions@csiny.org