Maldives Cyber Security Agency and Police Urge Immediate PHP Update Over Critical Vulnerability

The National Cyber Security Agency (NCSA) and the Maldives Police Service have issued an urgent warning for all systems using PHP to be updated immediately following the discovery of critical security vulnerabilities. The vulnerability, dubbed "PHP 2 Shell," has been assigned a CVSS v4.0 score of 9.2, categorised as "critical." It allows unauthorised code execution on servers without the need for a username or password, enabling attackers to take control of websites. Hackers are actively attempting to exploit the flaw, targeting platforms such as WordPress and all PHP-based systems. Authorities are urging system administrators to update to the official security patches: versions 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later. They also advise contacting hosting providers, monitoring systems, and reporting any suspected breaches to the Police Cyber Crime Center immediately.