Two critical vulnerabilities in PHP, the programming language powering approximately 70 percent of websites, have triggered widespread server security concerns. The flaws affect popular platforms including WordPress, Drupal, Joomla, and Magento, and allow attackers to execute code remotely and seize complete control over affected servers. PHP released emergency patches to address the issues, and security experts report that working exploits are already being deployed in the wild against vulnerable systems.
The vulnerabilities impact all PHP versions from 5.4 onward and have existed for decades, though recent advances in artificial intelligence made them exploitable. Security researchers estimate approximately 2.58 million internet-facing hosts and 54.9 million web properties run PHP. Government websites in Europe have already gone offline following disclosure, and analysts predict widespread website outages and mass exploitation through installation of remote access backdoors. Fixed versions are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Source: Read the full story at Krebs on Security
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
