Critical php flaws could expose personal data on millions of websites

Security specialist Karl Emil Nikka reports that two critical vulnerabilities in the php programming language were disclosed after an update on Wednesday, creating a broad attack surface. The flaws enable malicious actors to breach servers and extract data such as personal photos, email addresses and telephone numbers, while credit-card information remains relatively protected. Swedish intelligence agencies Säpo and FRA have been notified of the global IT incident that is straining internet traffic.

Nikka cautions that patch deployment will be uneven and may take months, leaving many sites vulnerable. He stresses that only website operators and their hosting services can respond, and that individuals without their own sites are largely unaffected. A temporary site outage does not automatically mean an attack, as it could be a preventive shutdown.