PHP flaws trigger rapid exploitation as operators race to patch
Two critical vulnerabilities could let attackers run code on affected servers. Cloudflare’s chief reported a sharp rise in exploit attempts after disclosure, while some operators took services offline.
Two critical vulnerabilities in PHP could allow remote code execution on affected servers, prompting developers to release security patches and urge users to upgrade. The Verge reported the flaws have existed for roughly 20 years, though accounts differ on the affected version range.
The PHP developers’ advisory rated the vulnerabilities 9.2 out of 10, according to The Verge. Security firm watchTowr said they affect every PHP version from PHP 5 onward. The number of exposed systems has not been established, and widespread PHP use does not mean every site was vulnerable.
Cloudflare chief executive Matthew Prince said the company observed thousands of exploit attempts in the 10 hours before public disclosure, rising to hundreds of thousands within two hours and millions by the following night. The figures are his account; the report did not provide a counting methodology.
Some services and agencies reportedly went offline as operators assessed exposure or applied fixes. The Verge cited temporary shutdowns involving 4chan and DeviantArt, as well as precautionary outages at some Dutch and Finnish government agencies and Pokémon services.
The vulnerabilities pose a particular challenge for older sites that are no longer maintained or cannot be updated, the report said. PHP developers urged users to install the patches as soon as they became available.
