You may or may not be aware that on the 20th of October two major vulnerabilities in the PHP programming language were identified and publicly disclosed. These vulnerabilities have been referred to as PHP2Shell.
These vulnerabilities are present in every version of PHP released in the last 20 years and allow an attacker to gain full remote access to a server with the highest level of privileges.
The potential risk of this vulnerability is so great, it is currently the main story on the UK’s Nation Cyber Security Center’s Website. The detailed breakdown is reported here: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
The NCSC is also contacting businesses that they identify may be using PHP on public facing servers for data processing and advising them to either turn off the server or patch it ASAP.
As WCMA uses PHP extensively in its public facing services (and due to this guidance), we have temporarily disabled:
1. All Badgenames portals
2. The WCMA Website
3. The WCMA API
These will remain offline while we investigate and remediate any potential issues that this exploit could cause.
Thank you for your patience in the meantime.