State urges Alaska schools to patch PHP flaws attackers are already using

The Alaska Department of Education & Early Development urged school districts in its November newsletter to find every system running PHP and update it or take it offline. It cited two flaws that federal officials say attackers are already using.

PHP is software that runs behind many websites, including ones built with WordPress. The flaws, known as PHP2Shell, can let an attacker take control of an affected web server running PHP without a password, according to the National Security Agency. From there, the agency said, an attacker could steal sensitive data, disrupt services or move deeper into a network.

PHP's developers released fixes Oct. 21. Five days later, the federal Cybersecurity and Infrastructure Security Agency added both flaws to its catalog of known exploited vulnerabilities, "which means attackers are already using them," the department's newsletter said.

In Alaska, a check by Alaska News last month found signs of PHP on at least 50 of 181 public-facing homepages sampled across state and local government, school districts, utilities, banks and credit unions. The check couldn't show whether any of those sites had installed the fixes.

PHP is often built into other software, so it may be running on systems district staff don't think of as using it, the department wrote. Districts without IT staff should ask their website and software vendors whether they have installed the fixes, the department said.

The fix is to update PHP to a patched release: version 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on which line a system runs. Systems that can't be updated right away, or that run PHP 8.1 or older, should go offline until they can be fixed, the newsletter said. The NSA advised replacing older, end-of-life PHP services that can't take the fixes.

CISA also advised organizations to list every system running PHP, starting with ones reachable from the internet, and to watch for warning signs of an attack, such as PHP opening a command line or downloading tools on a server.

The flaws are in PHP itself, not in the websites or apps built on it, the NSA said. Its advisory points to alerts from Britain's National Cyber Security Centre and from cyber agencies in Australia and the European Union.