Major PHP Flaw Could Cause Website Outages Today
Security updates for PHP, a key programming language for websites and web applications, are set to be released today, targeting two serious vulnerabilities that could cause significant disruption online if not addressed. In a recent advisory, PHP developers rated these vulnerabilities at 9.2 out of 10 in severity, prompting some cybersecurity experts to recommend that websites go offline temporarily if they cannot implement the fix right away.
The patch is anticipated to be available at 10 AM ET, although developers may release it sooner if details about the vulnerabilities become public or if there’s evidence of active exploitation. PHP users are strongly encouraged to upgrade as soon as the patch is released. According to cybersecurity firm watchTowr, these vulnerabilities are Remote Code Execution exploits affecting all PHP versions from PHP 5 onward, potentially allowing attackers to execute their own code on compromised servers, which could lead to website alterations, data theft, and more.
The potential impact is extensive, with estimates suggesting that over 1.3 million internet-connected hosts could be at risk. WordPress security plugin provider Wordfence has also highlighted that every WordPress site is vulnerable since they all operate on PHP servers, a significant concern given that WordPress powers more than 40 percent of the web. Additionally, Wordfence noted that the patch cannot be applied through automatic updates, meaning site owners must identify who manages their PHP updates to apply the fix manually.
Both the European Union Computer Emergency Response Team and the UK National Cyber Security Centre have advised companies unable to patch immediately to isolate their internet-facing applications from public networks or take them offline until the vulnerabilities are fully addressed. GrapheneOS, a mobile operating system developer, has temporarily shut down its user discussion forum due to the development of proof-of-concept exploits, stating they want to avoid any risks. PHP developer Gina Peter Banyard emphasized that patching is the only effective mitigation, suggesting that turning off servers might be the most prudent course of action.
Multiple cybersecurity organizations are urging PHP administrators to be ready, with threat researchers at Sansec predicting “mass attacks within 15 minutes of the release.” However, attackers are not waiting. Cloudflare’s chief technology officer, Dane Knecht, reported that “early attacks are emerging” against PHP sites, prompting Cloudflare to temporarily adjust its firewall rules as a precaution until the patch is available.
