Today we released an update on the latest PHP CGI vulnerability and provided some additional information that users can use to help protect against it.
Guidance includes updating your .htaccess file with the following:
RewriteEngine on
RewriteCond %{QUERY_STRING} ^[^=]*$
RewriteCond %{QUERY_STRING} %2d|- [NC]
RewriteRule .? – [F,L]
It is important to note however that if you are on WordPress and currently using our Free security plugin you are protected. We are actively seeing the attack across our growing network of plugin users and proactively pushing changes to protect our users.
What’s great about this is that its independent of what your host does. You can rest easy knowing that we’ve got your back.
Not Familiar With our Free Security Plugin?
You can find more information on the specifics by reading our Preventive page. The Security plugin is a new feature that we have recently released for free to all our WordPress clients.
Dutch Hill
Victor Santoyo
Antony Garand
Denis Sinegubko
Marc Kranat
Juliana Lewis
Krasimir Konov
Luke Leal
Ashley Sand
4 comments
Hi guys.
What if one is using Nginx instead? How do we go about addressing that or is that not an issue?
You guys provide a great security plugin that’ll take care of the PHP-CGI Vulnerability. Do you have any stats as to how many attacks has come through that vulnerability this year?
Hey there. We have raw numbers, nothing that we’ll post soon. We’d love to chat with you though. Can you drop us an email? info@sucuri.net – Have a great night!
Comments are closed.