Vulnerability PHP

Active
Sequence number:
AI-456-2026
Category:
General
From:
To:
Affected airports:
Bromma Stockholm Airport, Göteborg Landvetter Airport, Kiruna Airport, Luleå Airport, Malmö Airport, Ronneby Airport, Stockholm Arlanda Airport, Umeå Airport, Visby Airport, Åre Östersund Airport

What is happening or what needs to be done?

Critical vulnerabilities in the web tool PHP can enable remote code execution without login. Verify systems with Swedavia or suppliers that use PHP, especially internet-exposed systems or products where PHP may be built-in. If such a system is identified, contact Cyber Security via cybersecurity@swedavia.se so that the systems can be included in the ongoing inventory. Coordinated updating of already identified systems is underway.

 

Consequences? Who is particularly affected?

Affected systems are at risk of being compromised by an external attacker. Particularly affected are systems that use PHP to manage web traffic, including products where PHP is a built-in component and is not always obvious to management.

Which area of the airport is affected?

At present, there are no known internet-exposed PHP servers within Swedavia. Inventory and verification are ongoing.

For further information

Contact Cyber Security: cybersecurity@swedavia.se

Further information:

Published Latest change