PHP Fix Released as Early Attacks Put Websites on Alert

At 1345 GMT on Wednesday, the PHP team released fixes for two flaws that could let attackers take control of web servers without logging in. By then, government websites in the Netherlands and Finland had gone offline as a precaution, and security firm Cloudflare said it was seeing early attacks. The scramble is aimed at software used across much of the internet. ^1,3

The fixes are PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The flaws can disrupt how PHP handles memory during a web request, giving attackers a way to run code on the server. PHP developers urged users to update immediately. UK and European cybersecurity agencies advised taking vulnerable systems offline if they could not be fixed quickly. ^3,11

The risk reaches far beyond sites that advertise they use PHP. It runs about 75% of websites whose programming language can be identified and powers WordPress, used by roughly 43% of all websites, according to Reuters.¹ Finnish public services, parts of Wikimedia’s online infrastructure and other websites were taken down while operators worked to patch them.^7,9 Wiz said AI tools helped uncover the flaws after they had gone undetected for more than a decade. Building a working exploit required a complex chain of steps. ²

That scale makes finding every affected system a challenge, especially where PHP is built into older services or maintained by outside providers. The PHP team says updating is the only complete fix; temporary steps may reduce exposure but do not make a system safe.³ Administrators should find PHP installations, apply vendor updates and keep systems offline if they cannot be safely patched. ¹¹