TL;DR
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The PHP development team disclosed two critical vulnerabilities on October 21 that could let attackers run code remotely on affected servers without authentication. Patches are available for PHP 8.2 and later, but websites remain at risk until administrators install them; Russia faces particular exposure because PHP is reported to power more than 90% of its websites.
The PHP development team disclosed two critical vulnerabilities on October 21, warning that attackers could run code remotely on affected servers without authentication. Both bugs received a CVSS severity score of 9.2 out of 10; the risk is especially broad in Russia, where the source report says PHP powers more than 90% of websites.
The vulnerabilities affect PHP, software that runs server-side functions for websites and online services. According to the report by Meduza, the flaws stem from memory-handling errors that can cause a server to treat malicious data as safe. Attackers may be able to use them to access files or databases, insert code, change website content, redirect visitors, or use compromised servers for spam or distributed denial-of-service attacks.
Updates are available for PHP versions 8.2 and later, and developers have urged administrators to install them promptly. The report cites W3Techs estimates that PHP is used by almost 70% of websites worldwide. That figure describes PHP’s use across websites, not the number confirmed to be vulnerable or compromised.
The report also describes service disruptions as organizations responded to the risk. Public websites and services in several European countries were temporarily taken offline, while Russia’s domain registrar and hosting provider Reg.ru reported temporary restrictions on file uploads. Russian broadcaster TV Rain also temporarily took its website offline. These actions do not, by themselves, establish that those services were attacked or compromised.
Why Unpatched PHP Servers Matter
The bugs matter beyond website operators because a compromised server can put visitors and stored information at risk. If an attacker changes a familiar site’s content or redirects traffic, users could encounter phishing pages or harmful downloads. Unauthorized access could also expose files or databases, though the report does not say that such theft has occurred as a result of these vulnerabilities.
Patch availability does not mean every site is protected. Administrators must identify which PHP versions their systems use, apply the appropriate updates, and check connected services. The scale of PHP’s use means that delays can leave many separate websites exposed, but the available figures do not tell how many remain unpatched.
Russia’s reported PHP use makes the country a particular area of concern, not proof that Russian sites have been compromised at a higher rate. The confirmed examples in the report are temporary service restrictions and outages, rather than a tally of successful attacks.
As an affiliate, we earn on qualifying purchases.
PHP’s Reach and the Fix
PHP is an open-source scripting language created in 1995 by Danish programmer Rasmus Lerdorf. It remains common in web development, supported by a broad ecosystem and used by sites that would face substantial cost and work if they rewrote existing systems. The report says PHP powers more than 90% of Russian websites, while W3Techs estimates it is used by almost 70% of websites globally.
Researchers from two teams independently found the flaws and reported them to PHP developers, according to Meduza. OpenAI said the PHP team spent about two months working with Wiz, Cloudflare and other partners on fixes before disclosing the problems publicly. The report says researchers used AI systems as part of their discovery work; that detail does not mean the vulnerabilities were found or fixed by AI alone.
The PHP Foundation said an external security audit had detected signs of one flaw in 2024. Developers did not then identify a specific way to exploit it, according to the foundation’s account cited by Meduza. Calif researcher Thai Duong told The Wall Street Journal that the problem had been present in the code for decades. The report does not establish that the vulnerabilities were exploited during that period.
“An external security audit had detected signs of one of the vulnerabilities in 2024.”
— The PHP Foundation, as cited by Meduza
As an affiliate, we earn on qualifying purchases.
The Scale of Exposure Remains Unknown
There is no confirmed count in the source material of vulnerable sites, patched sites, or successful attacks tied to these flaws. The global PHP-use estimate and Russia’s reported adoption rate show potential reach, not the number of affected servers. It is also unclear how quickly organizations will install the updates or whether attackers have already used the vulnerabilities in the wild.
The report describes temporary shutdowns and upload restrictions as precautionary responses, but does not establish that those named services suffered intrusions. Nor does it provide the technical version-by-version breakdown needed to determine which deployments beyond PHP 8.2 and later require particular remediation. Administrators should consult PHP’s official security advisories for affected versions and patch instructions.
As an affiliate, we earn on qualifying purchases.
Administrators Must Apply the Patches
The immediate next step is for organizations running PHP to check their versions and install the relevant security updates, following guidance from the PHP project. Operators may also need to review server logs and access controls for signs of suspicious activity, though the source report does not prescribe a specific incident-response process.
Further information should clarify how widely updates have been adopted and whether investigators identify exploitation. Until then, the central distinction is between a serious vulnerability with fixes available and confirmed compromise: the report establishes the former, but does not provide evidence or totals for the latter.
website security monitoring software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are the PHP vulnerabilities?
They are two flaws involving how PHP servers handle memory. The report says both received CVSS scores of 9.2 out of 10 and could allow unauthenticated remote code execution on affected servers.
Which PHP versions have updates?
The source report says updates are available for PHP 8.2 and later. Administrators should check official PHP project advisories for the exact update relevant to their deployment.
Why is Russia considered particularly exposed?
The report says PHP powers more than 90% of websites in Russia. That indicates broad potential exposure, but it does not show how many Russian sites remain unpatched or have been compromised.
Have attackers exploited the vulnerabilities?
The source material does not confirm successful exploitation or provide a count of affected sites. It reports precautionary service disruptions in several countries and in Russia, which are not proof of an attack.
What should website operators do?
Operators should identify their PHP version and apply the relevant security update promptly. They should follow PHP’s official security guidance and assess their systems for suspicious activity.
Source: rss
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
