Cybersecurity agency urges updates to PHP, Node.js and Go — Taipei Times
The Cybersecurity Administration urged government agencies and businesses to immediately install updates for PHP, Node.js and Go. Developers reported vulnerabilities that could allow attackers to remotely execute code or intercept digital certificates, Taipei Times reports.
Vulnerabilities in PHP
PHP, Node.js and Go are open-source software. PHP is used as a server-side scripting language, Node.js is a JavaScript runtime environment, and Go is a programming language. Emergency updates for PHP and Node.js were released on Wednesday, while new Go versions were released on Monday.
The PHP security team identified two vulnerabilities rated 9.2 out of 10 under CVSS v4.0. According to the administration, they could allow unauthenticated remote execution of arbitrary code. PHP is widely used for websites, content management systems and administrative interfaces; WordPress, Drupal, Joomla and Magento also depend on it.
More current news is available on the UA.News Telegram channel Telegram.
Organizations were advised to check all PHP systems and related packages, determine their versions and install fixes in line with developers’ recommendations. After updating, system logs and unusual access attempts should be reviewed, and if suspicious activity is detected, the security of the relevant credentials should be checked.
Fixes for Node.js and Go
Node.js released three updated versions after fixing 10 vulnerabilities, four of which were classified as high risk. The main issue concerns the Brotli decoder: writing beyond allocated memory can cause memory corruption and potentially lead to remote code execution. The updates also fixed ways to bypass TLS certificate verification and the permissions model, as well as DNS resolution errors.
Go released two updated versions following an incident at an Indian intermediate certificate authority, which resulted in the disclosure of eight known private keys. According to the administration, attackers may use them for man-in-the-middle attacks. The new Go versions add the affected intermediate certificates to a blocklist. For this mechanism to work, developers need to recompile and redeploy applications after updating the Go toolchain.
