"A new version of the Santy worm appeared over the weekend, and according to analysis done by some security firms, poses a broader threat than its ancestors, which used Google to spot vulnerable Web bulletin boards, then defaced them," reports Information Week.
"Dubbed Santy.e, the worm differs significantly from its predecessors, said Moscow-based Kaspersky Labs in an alert. Rather than target only those Web sites running phpBB, software for creating Internet forums using the PHP scripting language, the worm can exploit any site that's left allowed arbitrary file inclusion into PHP scripts.
"Like earlier Santy variations, Santy.e uses Google to identify exploitable Web pages written in PHP which use the vulnerable functions "include()" and "require()." Santy.e, however, also throws Yahoo's and AOL's search engines into the mix, learning a lesson from the originals, which were stymied when Google blocked their searches."
