Two critical PHP vulnerabilities threaten websites worldwide
On October 21 the developers of the PHP programming language announced two critical vulnerabilities allowing remote code execution on servers. They put roughly 70% of websites at risk, and updates are already available.
The team behind the PHP programming language announced on October 21 that it had found two vulnerabilities, each rated 9.2 out of 10 on the CVSS cybersecurity severity scale, a critical level. They let an attacker run code remotely on a server without authentication. According to W3Techs estimates, about 70% of all websites use PHP, so the exposure is very broad. Developers urge immediate installation of updates, which are available for PHP 8.2 and later.
What PHP is
PHP is an open-source scripting language created by Danish programmer Rasmus Lerdorf in 1995. It runs the server side of many websites and online services. Its development involves the PHP Group, the nonprofit PHP Foundation and independent contributors. Many large sites, including Facebook, were originally built with PHP, and some still use it to avoid the cost of rewriting their code.
How the flaws work
Both stem from errors in memory handling. In the first, the system mishandles a request and crashes, and while clearing memory another error lets an attacker take remote control of the server. In the second, remnants of a previous user's data stay in memory, causing an error when a new request is processed and again allowing malicious programs to run. Attackers could reach files and databases, alter site content, redirect traffic, or use servers for spam and DDoS attacks.
How they were found
Two research teams discovered the flaws independently using AI models. Ryan Austin of the firm Calif found them in August, while researchers at Wiz reported the same problems to the developers. OpenAI said the PHP team spent two months working with Wiz, Cloudflare and other partners to prepare a fix before attackers could exploit the flaws widely. The PHP Foundation said an external security audit had spotted signs of one issue in 2024, but no concrete way to attack it was found then.
Who is at risk
Government agencies in Belgium, the United Kingdom, Denmark, the Netherlands, Finland and France temporarily took public sites offline. In Russia, where more than 90% of sites use PHP, hosting provider Reg.ru restricted file uploads and TV Rain briefly took its website down. Risk remains because only 216 million of almost half a billion websites are actively maintained, and many run older PHP versions where patches may be hard to install.
