Critical PHP flaws spark global patch rush and service disruptions
Researchers have identified two high‑risk vulnerabilities in the PHP programming language, prompting an emergency patch that was released ahead of schedule. Government cyber‑security agencies in several countries have issued urgent advisories urging administrators to apply the updates or temporarily suspend vulnerable services. The flaws have caused temporary disruptions on a range of websites, and some public‑sector portals were taken offline as a precaution. Cloud service providers reported a surge in attack attempts before the public announcement, while experts warn that simply applying the patches may not remove all risk.
How this was covered
- Right-leaning outlets covered this 16h later
- Coverage peaked at 14 outlets in a single hour
Why it matters
The vulnerabilities affect a core component of the web, so failure to patch could expose millions of sites to takeover and data loss.
How this story developed
- Oct 21 PHP to Issue Two Critical Emergency Patches Within 12 Hours
- Oct 21 EU’s CERT‑EU recommended that organisations unable to patch consider taking vulnerable sites offline.
- Oct 21 AI tools identified two severe remote-code execution bugs in PHP, forcing governments and companies to pull or patch sites as a fix was rushed out.
- Oct 22 German state portals, including Berlin and Hessen, were restored after applying the emergency PHP patches.
- Oct 22 Emergency patches for PHP 8.x have been released as the vulnerability spreads.
- Oct 22 Additional governments—including Denmark, the United Kingdom, Hungary, France, the Netherlands and Finland—temporarily disabled public websites while applying the PHP patches.
- Oct 23 Hong Kong’s Digital Policy Office issued an urgent advisory to patch the PHP vulnerabilities.
- Oct 23 Emergency patches were released for PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Related stories
9 in this thread