This week's threat report: suspected North Korean hackers are using artificial intelligence tools to break into government networks through two critical flaws in PHP, the code that runs a huge chunk of the web.
GitLab has patched a flaw that scores the maximum possible severity rating, letting an attacker take over self-managed servers without ever logging in.
A newly found bug in a compression tool used by Node.js, Bun and Python lets attackers run their own code on servers with no password needed.
Siemens has confirmed criminals are already exploiting a flaw in its Software Center tool, used across industrial and healthcare equipment, to plant malicious files on victims' machines.
Read on to find out more...
PHP is the computer language that runs a vast number of websites, including many built with WordPress, Drupal and Joomla. Security researchers found two serious flaws in PHP, nicknamed "PHP2Shell", that let an attacker take full control of a website without needing a password at all. NHS England has rated this a high-severity threat. Researchers now believe hackers linked to North Korea are using these flaws, helped along by artificial intelligence tools, to break into government computer networks and dig around inside them for passwords and sensitive files.
PHP runs on an enormous number of business websites and internal systems, including ones used by NHS suppliers and healthtech companies for patient-facing portals, booking systems and public websites. Because the attack needs no password at all, any unpatched PHP install is a target, and NHS England's cyber centre has already said further attacks are highly likely. Under the NHS Data Security and Protection Toolkit, suppliers are expected to patch critical vulnerabilities promptly, and this is exactly the kind of flaw assessors will expect to see acted on.
Recommendations:
GitLab is one of the most widely used platforms for teams to store and manage their software code. GitLab found a serious flaw in the version organisations run themselves (self-managed, not GitLab's own cloud service) that scores 10 out of 10 for severity, the highest score possible. Under the right conditions, an attacker who isn't even logged in could run their own code on the server. The flaw has existed in GitLab's code for around twelve years, reaching back to very old versions, because of a fault in how GitLab reads a certain type of pattern-matching code. GitLab says it has seen no evidence yet of real-world attacks, but has urged anyone running their own GitLab server to update straight away.
Many UK software and healthtech companies, including NHS suppliers that build and maintain their own digital health products, use GitLab to manage their code. A flaw this severe, in a tool that often holds a company's most valuable and sensitive source code, is a serious risk if left unpatched, especially given it can be reached without any login at all. Firms working towards DSPT or Cyber Essentials standards should treat a 10 out of 10 severity bug in core infrastructure as an urgent priority.
Recommendations:
Brotli is a compression tool made by Google that is built into huge amounts of software to shrink files and web traffic so pages load faster. Researchers found a flaw in how some programs unpack Brotli-compressed data, which can let an attacker send specially crafted data that corrupts the computer's memory and, in the worst cases, lets them run their own commands on the server. This affects Node.js, a hugely popular tool for building websites and apps, as well as Bun, Python, and networking tools like Envoy and Istio. Researchers have already shown this can be turned into a working attack on Node.js, with no password needed, and more products are still being checked.
Node.js and Python are two of the most common building blocks behind modern websites, patient portals and internal tools used across UK businesses and digital health organisations. Because the flaw sits in a shared compression library rather than one single product, it can turn up in places IT teams don't expect, including software provided by third-party vendors. Any NHS supplier running custom web applications built on these platforms should check with their development team whether they are affected.
Recommendations:
Siemens Software Center is a tool used to install and manage Siemens software across industrial and engineering systems, some of which sit within healthcare and NHS estate environments. Siemens has confirmed that criminals are exploiting a flaw in it by pairing a genuine, properly signed copy of the Software Center with their own malicious file, tricking the program into loading the attacker's code when it runs. Siemens says its own official software and update channels were not broken into; instead, attackers are getting their malicious files onto target machines some other way and relying on the flaw to run them. NHS England's cyber centre believes further attacks using this method are highly likely.
Siemens equipment and software appear widely across industrial control systems, building management and some medical equipment environments used by NHS trusts and their suppliers. Because the attack relies on tricking a trusted, genuinely signed piece of software, normal checks that only look for "is this file official" will not catch it, which makes it a useful technique for attackers trying to get a foothold inside a target's network. Any organisation running Siemens Software Center, including facilities and estates teams, should treat this as a live risk rather than a theoretical one.
Recommendations:
Want help staying ahead of threats like these? Contact Periculo about our Threat Intelligence services.