Russia's National Coordination Center for Computer Incidents (NCCCI), which operates under the Federal Security Service (FSB), has instructed operators of critical information infrastructure to address dangerous vulnerabilities in PHP, a programming language used by many websites and online services.
Organizations unable to update their software promptly have been advised to consider restricting external access to vulnerable servers, up to and including temporarily taking them offline.
RBC reported the directive on October 22 after obtaining a copy of the letter. Three organizations that received the document confirmed its authenticity.
The instructions were distributed through GosSOPKA, Russia's state system for detecting, preventing, and responding to cyberattacks.
The letter directs organizations to update PHP to a version in which the identified vulnerabilities have been fixed. After updating, they must scan their servers with antivirus tools and examine event logs for possible signs of compromise.
Suspicious incidents must be reported to GosSOPKA's operations center.
The directive was prompted by two critical PHP vulnerabilities discovered with the help of artificial intelligence. According to specialists, the flaws could potentially allow attackers to execute code remotely on a server without authorization, access files and databases, or alter website content.
On October 21, PHP developers disclosed the issues and released fixes for supported versions of the software.
The directive concerns information infrastructure operated by government agencies and financial, energy, transport, healthcare, and other organizations whose operations are considered critically important.
It does not, however, impose an unconditional mass shutdown of all websites using PHP. Installing the fixes is the primary measure. Restricting external access is described as a temporary precaution when a system cannot be updated promptly.
Because the identified vulnerabilities are in PHP itself, updating a content management system alone, without installing a fixed PHP version, may not eliminate the threat.
The agency has not reported a confirmed widespread compromise of Russian critical infrastructure through these vulnerabilities. The letter is primarily intended to prevent potential cyberattacks.