PHP released emergency security patches on Wednesday for two critical flaws. The vulnerabilities carry a severity score of 9.2 out of 10. Some security agencies are telling sites that cannot patch to take their systems offline instead.
PHP runs on the servers behind most of the modern web. WordPress alone powers more than 40 percent of all websites, and every WordPress site depends on PHP underneath. That makes this one of the broadest patching events of the year.
The advisory went out on Tuesday, according to The Verge. The fix landed at 10AM ET on Wednesday. Developers urged users to “upgrade as soon as the release is available.”
What the flaw allows
Cybersecurity firm watchTowr says both bugs are remote code execution exploits. They affect every PHP version from PHP 5 onward. An attacker who reaches a vulnerable server can run their own code on it. From there they can rewrite pages, plant malware, or pull data out of a database.
One researcher estimates that more than 1.3 million internet-connected hosts are exposed. That figure only counts machines that answer scans directly. Shared hosting stacks hide many more sites behind a single address.
The patch is not arriving through normal channels. Wordfence warned that the update cannot be applied by WordPress automatic updates. Site owners have to find whoever manages PHP on their server and ask for a manual upgrade. On managed hosting that may mean opening a support ticket and waiting for a reply.
A weekend of maintenance
Smaller sites are the most exposed. A hobby blog on a cheap shared plan often runs an old PHP branch that the host never touches. Agencies that maintain client sites now have to audit every stack they manage.
The timing matters too. The disclosure landed midweek, which leaves little room before the weekend. Attackers tend to weaponize public advisories within days. A working proof of concept can appear in hours when a bug is this severe.
Anyone running a self-hosted site should check their PHP version today. The command php -v gives the answer on most servers. If a hosting control panel offers several branches, move to the newest supported release and then confirm the change actually took effect on the live site.
For a local example of the same weak spot, see our report on the Albert Heijn hack and the new Dutch Cybersecurity Act. The software that keeps websites running is also one of the easiest ways in.
Source: The Verge, watchTowr, Wordfence
The Netherlands, for internationals
One email a week: the week's news for internationals in the Netherlands, new practical guides and what changed in the cities. No spam, unsubscribe any time.
