Alaska education department tells districts to patch actively exploited PHP flaws

The Alaska Department of Education & Early Development told school districts in its November newsletter to find every system running PHP and update it or take it offline. It cited two flaws that federal officials say attackers are already using.

PHP runs many school websites and is often built into other software, so it may be on systems district staff don't think of as PHP servers, the department wrote. Alaska News reported Oct. 23 that fixes for the flaws were out. A check by Alaska News then found PHP-linked signals on at least 50 of 181 public-facing homepages sampled across state and local government, school districts, utilities, banks and credit unions.

The flaws, called "php2shell," let an attacker take control of a web server running PHP without logging in, according to a Cybersecurity and Infrastructure Security Agency alert issued Oct. 21, the day PHP released a patch. CISA added both to its Known Exploited Vulnerabilities catalog on Oct. 26, which means attackers are already using them, the newsletter said.

The fix is updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Systems that can't be updated right away, or that still run PHP 8.1 or earlier, should go offline until they can be patched. CISA also advised organizations to inventory every system running PHP, starting with internet-facing ones, and to watch for PHP worker processes launching shells or downloading tools.

Districts without IT staff to do this should ask their website and software vendors whether they have patched, the department said.

The NSA, Britain's National Cyber Security Centre and other agencies issued parallel advisories. The NSA said the flaws sit in PHP itself, not in the applications built on top of it, and advised replacing end-of-life PHP services that can't take current patches.