01
Security
Two critical PHP flaws let attackers take over unpatched servers without a password
Patches arrived on October 21, but a separate unpatched flaw has since been disclosed, and confirmed attacks show the risk is real.
Patches arrived on October 21, but a separate unpatched flaw has since been disclosed, and confirmed attacks show the risk is real.
Server operators running affected configurations must disable one setting now, while attackers have so far mostly probed the PHP2Shell flaws without confirmed compromises.
Defenders should not treat the public disclosure date as the earliest point at which the flaws were exploited.
The breach at TeamUpdraft has moved from a single vendor incident to active attacks on customer WordPress sites.
A CSRF flaw in Elementor’s Editor Events module is patched in version 4.3.2, and users are urged to upgrade quickly.
Admins on unpatched sites can be tricked into installing themes that execute PHP, exposing files, data and accounts.