Following the cyberattacks on ASOS, Whistles & Hobbs and Intermarché, another major cybersecurity story emerged this week. Researchers identified two critical vulnerabilities in PHP, the programming language that underpins many websites and web applications, including those built on platforms such as WordPress and Magento. The flaws could allow unauthenticated remote code execution, potentially enabling an attacker to take control of a vulnerable web server without needing to log in.
Details of the vulnerabilities became public on 20 October, before the planned release of security fixes. The PHP project responded by issuing emergency patches on 21 October. As organisations worldwide rushed to update their servers, a number of government agencies and other organisations temporarily took websites and online services offline as a precaution while patches were deployed and systems checked for exposure.
There is currently no public evidence that hostile agents managed to exploit the vulnerabilities before the fix was deployed, but from a retail perspective, the potential threat was extremely severe. Many retail platforms and content sites run on PHP, and the risk wasn’t specifically a WordPress bug or a Magento bug; it was in the underlying PHP runtime itself. A retailer could have fully updated application software and still be vulnerable if the server PHP version wasn’t patched.
“Wake-up call” for retailers
The incident yet again highlights the extent to which retailers depend on technology beyond their direct control. Adrian Podkaminer, chief information security officer at G2A.COM, described it as a “wake-up call” for ecommerce businesses and warned that they must now ascertain whether attackers have gained access to their data.
“Taking a site offline may reduce further risk, but it cannot show whether customer information has been compromised,” he said. “Organisations must investigate for compromise and, if a service cannot be secured, follow NCSC guidance and consider taking it offline.”
Cybercriminals are looking for vulnerabilities
Cybercriminals are often steps ahead of tech company research teams and actively looking for flaws to exploit, as Podkaminer points out: “This incident also shows why zero-day attacks demand a different mindset: exploitation can begin before defenders know a vulnerability exists. AWS observed a PHP2Shell exploitation attempt four days before public disclosure, so organisations should investigate from the earliest known activity, not simply from the date an advisory or patch was published.
He added: “For critical internet-facing systems, rapid patching must be backed by behavioural detection, threat intelligence and evidence-led incident response. This also indicates why multilayered security approach is necessary.”
If recent attacks have highlighted the cost of getting cybersecurity wrong, the PHP incident highlights the cost of assuming someone else’s technology is someone else’s problem. In retail, third-party and open-source risk has become business risk.
Stay informed
Our editor carefully curates two newsletters a week filled with up-to-date news, analysis and research. Click here to subscribe to the FREE newsletter sent straight to your inbox. Why not follow us on LinkedIn to receive the latest updates on our research and analysis?
