PHP Developers to Release Critical Patches for Remote Code Execution Flaws
Security updates for the PHP language aim to fix two severe vulnerabilities affecting millions of internet hosts and WordPress sites.
Key points
- PHP developers are releasing patches for two critical vulnerabilities with a 9.2 severity rating.
- The flaws allow remote code execution on every PHP version from PHP 5 onward.
- Agencies advise isolating or taking offline systems that cannot be patched immediately.
PHP developers are preparing to release security patches today to address two critical vulnerabilities in the programming language. These flaws, rated 9.2 out of 10 for severity, could allow attackers to execute arbitrary code on affected servers, potentially compromising millions of websites globally.
The update is scheduled for release at 10 AM ET today, though developers may distribute it earlier if exploit details leak or active attacks are detected. According to The Verge, users are urged to upgrade as soon as the release becomes available to prevent unauthorized access and data theft.
Context and Background
Cybersecurity firm watchTowr identified the vulnerabilities as remote code execution exploits impacting every PHP version from PHP 5 onward. Attackers leveraging these flaws could run their own code on servers, allowing them to maliciously alter websites or steal sensitive data. The widespread nature of PHP makes this a significant threat to web infrastructure.
The European Union Computer Emergency Response Team and the UK National Cyber Security Centre have issued advisories regarding the threat. Both agencies encourage organizations that cannot immediately patch their platforms to isolate internet-facing applications from public networks or take them offline entirely until mitigation is complete.
Who Is Affected
One security researcher estimates that more than 1.3 million internet-connected hosts are likely affected by these vulnerabilities. Wordfence, a WordPress security plugin provider, warned that every WordPress site is vulnerable because they all run on servers using PHP. WordPress reported last year that it powers more than 40 percent of the internet.
Wordfence also noted that the fix cannot be installed using automatic updates. Site owners must identify who is responsible for updating PHP on their infrastructure and apply the patch manually. This requirement adds complexity for organizations relying on automated maintenance tools for server-side language updates.
What should you do?
Organizations should monitor official PHP channels for the release of the security patches today. Administrators unable to apply updates immediately should follow guidance from cybersecurity agencies to isolate affected systems. Manual verification of PHP versions is necessary to confirm exposure, as automatic updates will not resolve this issue.
What to do and how to stay safe: PHP
- Identify all servers running PHP versions 5 or higher to determine exposure scope.
- Isolate internet-facing applications from public networks if immediate patching is not possible.
- Coordinate with hosting providers or IT teams to manually apply the PHP update once released.
- Monitor server logs for signs of unauthorized code execution or unusual activity during the window.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity rating of the PHP vulnerabilities?
PHP developers assigned the vulnerabilities a severity rating of 9.2 out of a possible 10, indicating a critical risk level.
Will automatic updates fix the PHP vulnerabilities?
No, Wordfence warned that the fix cannot be installed using automatic updates, requiring manual intervention by site owners or administrators.
Which PHP versions are affected by these flaws?
According to watchTowr, the remote code execution exploits impact every PHP version from PHP 5 onward, affecting a wide range of legacy and current installations.
