Security patches for the PHP programming language, which powers a vast portion of the web, have been released today to address two critical vulnerabilities that pose a significant threat to the internet's stability. In an advisory released on Tuesday, PHP developers highlighted a severity rating of 9.2 out of 10 for these issues. Consequently, cybersecurity agencies are advising websites that cannot apply the fix immediately to consider temporarily taking their systems offline.
The security update was made available at 10 AM ET, with PHP users strongly urged to "upgrade as soon as the release is available." According to cybersecurity firm watchTowr, the vulnerabilities are Remote Code Execution exploits that reportedly impact every PHP version from PHP 5 onward. These flaws could allow attackers to execute their own code on susceptible servers, enabling them to maliciously alter websites, steal sensitive data, and perform other malicious activities.
The potential impact of these vulnerabilities is extensive, with one security researcher estimating that more than 1.3 million internet-connected hosts are likely at risk. The security plugin provider Wordfence also issued a warning, stating that every WordPress site is vulnerable because they all rely on PHP servers. Wordfence pointed out that the fix cannot be installed via automatic updates, necessitating that site owners identify the responsible party for PHP updates to apply the patch manually.
Both the European Union Computer Emergency Response Team and the UK National Cyber Security Centre have issued advisories encouraging companies that cannot patch immediately to isolate their internet-facing applications from public networks or take them offline completely until the vulnerabilities are fully mitigated. Mobile operating system developer GrapheneOS has temporarily taken its user discussion forum offline because proof-of-concept exploits are already emerging, and the team "doesn't want to take the risk." According to PHP developer Gina Peter Banyard, patching is the sole mitigation strategy, and otherwise, shutting down servers might be the most sensible course of action.
Multiple cybersecurity organizations have called for preparedness, with threat researchers at Sansecs predicting they expect to see "mass attacks within 15 minutes of the release." This urgency is already apparent, as Cloudflare Chief Technology Officer Dane Knechts noted, "we are seeing early attacks emerging" against platforms utilizing PHP. In response, Cloudflare is temporarily updating its firewall rules to act as a stopgap measure until the official fix is available.
Update, October 21st: Updated language to reflect that the security patches have now been released.
A free daily digest of the news that matters most.
This is the title for the native ad
The Editorial Staff at AIChief is a team of professional content writers with extensive experience in AI and marketing. Founded in 2025, AIChief has quickly grown into the largest free AI resource hub in the industry.