PHP hack

If you drop by, you’ll be greeted by this notice, which has been there for 5 days now:

So yes, there is a problem – a big one, because it turns out there’s a vulnerability in the realization of “register_globals” in PHP. Hosting providers are starting to fix the bug; last night Masterhost, the biggest Russian hosting provider, sent the following message to all its clients…

Уведомляем Вас, что в понедельник 9 февраля 2009 г. будет
изменена конфигурация серверов виртуального хостинга.
Директива PHP register_globals будет отключена, согласно
рекомендациям разработчиков PHP и специалистов по
безопасности. Изменение затронет следующие площадки и домены:
xxx, xxx, xxx
Если Ваши сайты используют последние версии популярных CMS
(таких как Joomla, WordPress, Drupal, Bitrix и т.д.), то
изменение пройдет незаметно и не скажется на
работоспособности ресурсов. Рекомендуем при возможности
произвести обновление Ваших скриптов. Если это сделать
невозможно или у Вас возникают любого рода сомнения, то Вы
можете обезопасить себя и включить register_globals для
сайта, добавив в директорию www файл .htaccess со следующей
php_flag register_globals on
Информация о директиве register_globals на сайте
разработчиков PHP:


This is to inform you that on 9th February 2009 the configuration of virtual hosting servers will be modified. The PHP register_globals directive will be disabled in line with recommendations from PHP developers and security specialists. The changes will affect the following sites and domains:
If your sites are using the most recent versions of popular CMS (such as Joomla, WordPress, Drupal, Bitrix etc.) then you won’t notice the changes taking place and they won’t affect resource productivity. We recommend that you update your scripts when possible. If this is not possible or if you are in any doubt, you can secure yourself by enabling register_globals for the site by adding the .htaccess file to the www directory with the following directive:
Php_flag register_globals on
There is information about the register_globals directive on the PHP developers’ site:

The moral of this story? Check your sites, update your sites, tell your IT guys. And while you’re doing this, we’ll be keeping an eye out for the next Big Chinese Hack – the exploit for this vulnerability was released more than two weeks ago, but most hosting providers are still unpatched; a lot of Internet resources are going to take a beating over the next few days and weeks, and botnets are going to be increasing (again) in size. All the more so with the approach of February 14th, traditionally a time when the bad guys mobilize…

PHP hack

Your email address will not be published. Required fields are marked *



APT trends report Q1 2024

The report features the most significant developments relating to APT groups in Q1 2024, including the new malware campaigns DuneQuixote and Durian, and hacktivist activity.

Subscribe to our weekly e-mails

The hottest research right in your inbox