PHP scripting flaw ripe for Web worm...

March 5, 2002

Profile used our newssubmit to tell us that a million Web sites are vulnerable to a set of newly discovered scripting flaws:

Last Wednesday, a member of the PHP Group posted details of a handful of flaws that could be exploited to take over Web servers that use version 3.0.10 to version 4.1.1 of the PHP software. By gaining control of the Web server software, attackers could deface any sites hosted by that server or take advantage of their position to issue system commands to the server.

Two days later, U.K.-based Internet research group Netcraft released its monthly survey of Web sites, indicating that nearly 8.4 million sites were hosted by servers that use a vulnerable version of PHP. One million of those sites are vulnerable to attack, the survey said.

The PHP scripting language is one of the most popular languages to build internet sites these days and as you might know CD Freaks also uses it. I hope there's no reason to be alarmed (I'm no expert here as you might have guessed )...