Agency announces critical patches for cybersecurity - Taipei Times
The Administration for Cybersecurity has urged government agencies and businesses to immediately install security updates for PHP, Node.js and Go after discovering critical vulnerabilities.
The Administration for Cybersecurity yesterday urged government agencies and businesses to immediately install security updates for PHP, Node.js and Go after developers disclosed vulnerabilities that could allow attackers to remotely execute code or intercept digital certificates. All three are open-source software: PHP is a server-side scripting language, Node.js is a JavaScript runtime environment and Go is a programming language.
PHP vulnerabilities
Emergency safety updates for PHP were issued on Wednesday. The PHP safety team identified two security loopholes, with the vulnerabilities rated 9.2 out of 10 under the CVSS v4.0 scoring system. PHP is used extensively for websites, content management systems and administrative interfaces, with systems such as WordPress, Drupal, Joomla and Magento also relying on it.
The loopholes could allow hackers to remotely execute arbitrary code without authentication.
Node.js fixes
Node.js issued three updated versions after patching 10 loopholes, four of which were rated as high-risk vulnerabilities. The main security loophole affects the Brotli decoder and involves an out-of-bound write that could cause memory corruption and potentially lead to remote code execution.
We urge organizations to check their servers and docker image, and upgrade to secure versions as soon as possible.
Go certificate issues
Go offered two updated versions following a recent security incident in an Indian intermediate certificate authority, which exposed eight known private keys. The stolen keys could be used by hackers to launch man-in-the-middle attacks. The new Go versions add the affected intermediate certificates to a blocklist to reduce the risk of abuse of the certificate trust chain.
Developers using the programming language must recompile and redeploy applications after updating the Go toolchain for the certificate-blocking mechanism to take effect. Updating only the development or runtime environment is not sufficient.
Related
