TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
PHP’s development team disclosed two vulnerabilities rated 9.2 out of 10 on the CVSS scale, both of which could let attackers run code remotely without authentication. Updates are available for PHP 8.2 and later, but the number of sites still exposed is unknown. Russia may face heightened exposure because PHP reportedly powers more than 90% of sites there.
The PHP development team disclosed two critical vulnerabilities on October 21 that could allow unauthenticated attackers to run code on affected servers. Both flaws received a CVSS score of 9.2 out of 10, and the developers urged administrators to install updates; patches are available for PHP versions 8.2 and later.
The flaws affect how PHP handles server memory. According to the report, one involves a request being processed incorrectly, followed by a failure when the server tries to release memory. The other leaves data from a previous request in memory, causing an error when the server processes a new one. In both cases, the reported outcome is that malicious code could run remotely.
If exploited, the vulnerabilities could enable attackers to access files or databases, insert code, change website content, redirect visitors, or use compromised servers for spam or distributed denial-of-service attacks. These are potential consequences; the source material does not establish how many attacks have occurred or confirm widespread exploitation.
W3Techs estimates that PHP is used by almost 70% of websites worldwide. The report says the language powers more than 90% of sites in Russia, placing the country among those with particularly broad potential exposure. The figures describe PHP use, not the number of sites confirmed vulnerable or left unpatched.
Why Slow Patching Leaves Sites Exposed
A patch only reduces risk after the software is updated. Organizations running affected PHP versions may remain exposed if administrators do not apply fixes, and the source provides no count of how many systems have been patched. That gap matters because PHP’s widespread use means the vulnerabilities could affect a large range of websites and online services.
The consequences can reach beyond site operators. If an attacker compromises a website, visitors could encounter altered pages, phishing attempts, or malicious software. A server takeover could also disrupt access to a service or expose information held on the system. Users may face indirect risks even when they do not run PHP themselves.
The report says some public agencies in Belgium, the United Kingdom, Denmark, the Netherlands, Finland, and France temporarily took websites or services offline, and agencies in more than a dozen countries took similar measures. In Russia, hosting provider Reg.ru reported temporary restrictions on file uploads, while TV Rain temporarily took its website offline. These responses show that organizations acted cautiously; they do not by themselves confirm that those sites were attacked.
As an affiliate, we earn on qualifying purchases.
How PHP Became a Web Mainstay
PHP is an open-source scripting language created by Danish programmer Rasmus Lerdorf in 1995. It is used mainly to run server-side features on websites. Its broad adoption reflects its focus on web development, its accessibility, and a large ecosystem built around it. Many sites continue to use PHP because replacing established systems can require substantial time and cost.
The vulnerabilities were found independently by researchers from two teams, according to the report. Researchers at Wiz reported the issues to PHP’s developers. The report also says Ryan Austin of Calif identified them using an AI model. OpenAI said PHP developers worked for two months with Wiz, Cloudflare, and other partners on fixes before the issue became widely known.
The PHP Foundation said an external security audit had detected signs of one flaw in 2024, but developers at the time did not identify a specific way to exploit it. Thai Duong, head of Calif, told The Wall Street Journal that the problem had been present in the code for decades. The source does not provide enough technical detail to independently assess that characterization.
“The developers strongly recommend installing updates immediately.”
— PHP development team
As an affiliate, we earn on qualifying purchases.
How Many Servers Remain Vulnerable
The number of websites still running vulnerable PHP versions is not established in the source material. W3Techs’ estimate measures PHP’s prevalence, not the number of affected installations, and no patch-adoption figures are provided. The report also does not confirm whether attackers have exploited either flaw in the wild or how many systems, if any, have been compromised.
The exact exposure may depend on software versions, configurations, and whether an organization has applied relevant updates or other mitigations. The source says patches are available for PHP 8.2 and later but does not specify the status of every older version or give a complete list of affected releases.
As an affiliate, we earn on qualifying purchases.
Administrators Need to Check Versions
Website operators and hosting providers need to identify which PHP versions their systems run and apply the relevant security updates where available. Organizations should also check whether services were temporarily restricted or taken offline and confirm when they can safely resume normal operation.
Further information on patch adoption, affected installations, and any confirmed exploitation would clarify the scale of the incident. Until those details are available, the confirmed position is that two critical flaws have been disclosed, updates exist for PHP 8.2 and later, and the number of systems still at risk remains unknown.
PHP vulnerability mitigation software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did PHP developers disclose?
They disclosed two vulnerabilities on October 21, each rated 9.2 out of 10 on the CVSS scale. The flaws could allow remote code execution without authentication on affected servers.
Are updates available?
Yes. The source says updates are available for PHP versions 8.2 and later and that developers urged administrators to install them promptly. It does not provide a complete account of older-version support.
Why is Russia described as particularly exposed?
The report says PHP powers more than 90% of websites in Russia. That indicates broad potential exposure, but it does not mean all those sites are vulnerable or unpatched.
Have attackers exploited the flaws?
The source material does not confirm exploitation or provide a count of compromised websites. It describes what attackers could do if they reached an affected, unpatched server.
How could website visitors be affected?
A compromised site could have its content altered or visitors redirected, potentially exposing them to phishing or malicious software. Visitors could also lose access if a service is taken offline.
Source: rss
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
