PHP security flaws spark global scramble as patch released amid hacker attempts
Two critical PHP vulnerabilities were disclosed, prompting a rapid patch release while attackers launched a surge of exploitation attempts.
Early disclosures of two major PHP security holes spread on Tuesday, gaining momentum after a security company mistakenly posted a video showing how they could be exploited. The following day, security agencies worldwide issued alerts, and on Wednesday the PHP Foundation released a patch that seals the vulnerabilities while outlining hacker techniques, leading to a rapid increase in intrusion attempts. AWS identified an intrusion attempt on a controlled honey-pot server, traced to anonymous VPN-based IP addresses and likely tied to hostile actors, but technical analysis is ongoing and no successful breach of production systems has been confirmed.
The PHP Foundation admitted it had known about an underlying issue since 2024 but lacked sufficient detail to act earlier, citing internal disagreements and resource constraints that delayed a fix. The organization described the delay as a structural failure involving decision-making processes and limited resources.
Why it matters
The flaws affect most web servers worldwide, so timely patching is crucial to prevent widespread cyber attacks.
How this story developed
- Oct 20 Google cloud outage disrupts banks, courts and apps across Europe
- Oct 20 Google has pledged to publish a full analysis of the incident.
- Oct 21 PHP maintainers announced they will release emergency updates for two high-severity flaws, each rated 9.2/10, in just over a day.
- Oct 21 EU’s CERT‑EU recommended that organisations unable to patch consider taking vulnerable sites offline.
- Oct 21 AI tools identified two severe remote-code execution bugs in PHP, forcing governments and companies to pull or patch sites as a fix was rushed out.
- Oct 22 German state portals, including Berlin and Hessen, were restored after applying the emergency PHP patches.
- Oct 22 Emergency patches for PHP 8.x have been released as the vulnerability spreads.
- Oct 22 Additional governments—including Denmark, the United Kingdom, Hungary, France, the Netherlands and Finland—temporarily disabled public websites while applying the PHP patches.
- Oct 23 Hong Kong’s Digital Policy Office issued an urgent advisory to patch the PHP vulnerabilities.
In this story
Related stories
10 in this thread