TL;DR
Get travel and outdoor gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
PHP’s development team disclosed two critical vulnerabilities on October 21 that can let attackers run code remotely on affected servers without authentication. Updates are available for PHP 8.2 and later, but the number of sites still vulnerable is unknown; Russia faces elevated exposure because PHP reportedly powers more than 90% of its websites.
The team behind PHP disclosed two vulnerabilities on October 21, each rated 9.2 out of 10 on the CVSS severity scale, that can allow attackers to run code remotely on vulnerable servers without authentication. The flaws put websites using affected PHP versions at risk, with Russia particularly exposed because the language reportedly powers more than 90% of sites there; developers say updates are available for PHP 8.2 and later.
The vulnerabilities stem from memory-handling errors in PHP. According to the report, each flaw can make the server treat malicious data as safe, opening a path for an attacker to execute code. One involves a request being processed incorrectly and a failure while memory is freed; the other involves data left in memory from a previous user interfering with a new request.
Successful exploitation could give attackers access to server files or databases, let them insert malicious code or change site content, and enable redirects, spam campaigns or distributed denial-of-service attacks. The immediate advice from PHP’s developers is to install the security updates. Patches are available for versions 8.2 and later, but the source material does not specify patch availability for older releases.
W3Techs estimates that PHP is used by nearly 70% of websites worldwide. The report says its share exceeds 90% in Russia. Those figures describe PHP’s reach, not the number of websites confirmed vulnerable: exposure depends on the PHP version and whether the relevant update has been installed.
Why Unpatched PHP Servers Matter
A compromised website can put more than its operator at risk. Attackers who alter a familiar site could use it to deliver phishing pages or infected software, while access to files and databases may expose information held by the site. Downtime is another possible consequence if operators take services offline to limit exposure or attackers disrupt them.
The reported high use of PHP in Russia means a large share of its web infrastructure may depend on administrators applying the fixes. That is a measure of potential exposure, not proof that Russian sites have been attacked or that every PHP-powered site is affected. The report says some public agencies in European countries temporarily took websites or services offline, while Russian hosting provider Reg.ru restricted file uploads temporarily and TV Rain took its website offline. These examples show operational precautions; they do not establish that those organizations were exploited.
As an affiliate, we earn on qualifying purchases.
How the Flaws Were Found
Researchers from two teams identified the vulnerabilities independently and reported them to PHP’s developers. The report says researchers at Calif and cybersecurity company Wiz used AI systems alongside other tools. OpenAI said the PHP team worked for two months with Wiz, Cloudflare and other partners to prepare fixes before the issues became widely known.
The PHP Foundation said an external security audit had flagged signs of one vulnerability in 2024. At that time, developers could not identify a specific method to exploit it, according to the foundation’s account. Calif head Thai Duong told The Wall Street Journal that the problem had been present in the code for decades. That duration is an attributed claim, not an independently established timeline in the material provided.
PHP is an open-source language created by Rasmus Lerdorf in 1995 and remains widely used for server-side web development. Its extensive existing use helps explain why a security update can affect organizations across many sectors: upgrading systems requires administrators to identify affected installations, test changes and deploy patches.
“They strongly recommend installing updates immediately.”
— PHP developers, as described in the report
As an affiliate, we earn on qualifying purchases.
How Much Exposure Remains
The number of sites that remain vulnerable is not established in the source material. The estimate that PHP powers nearly 70% of websites worldwide does not show how many run affected versions or have yet to install patches. The report also does not provide a complete breakdown of affected PHP releases, a confirmed count of exploited servers, or evidence that attackers have used these flaws in the wild.
It is also unclear how many organizations have completed updates. The report notes that the PHP Foundation’s account of an audit finding dates to 2024, but does not establish whether attackers knew of or exploited either vulnerability before the October disclosure. Reports of temporary restrictions and website shutdowns describe defensive measures and should not be read as confirmation of a breach.
As an affiliate, we earn on qualifying purchases.
Patch Deployment and Exploitation Checks
Administrators should identify the PHP versions running on their servers, apply the relevant updates and check that fixes are active across production systems. Organizations using older versions should consult official PHP security guidance for applicable support and upgrade options. The development team and researchers may provide further technical details, while hosting providers and affected organizations can clarify how widely patches and precautionary measures have been adopted.
Until deployment figures or verified incident reports are available, the central issue is the gap between a patch being released and every affected server receiving it. Readers and site users should treat claims of active attacks as unconfirmed unless supported by additional reporting or security advisories.
As an affiliate, we earn on qualifying purchases.
Key Questions
What do the PHP vulnerabilities allow an attacker to do?
According to the report, the flaws can enable unauthenticated remote code execution on a vulnerable server. Depending on access gained, attackers could potentially affect files, databases, website content or service availability.
Which PHP versions have updates?
The source says updates are available for PHP 8.2 and later. It does not specify the status of every older release, so administrators should check official PHP security guidance for their version.
Does the 70% figure mean 70% of websites are confirmed vulnerable?
No. W3Techs’ estimate describes the share of websites using PHP. The number actually vulnerable depends on software versions and patch status, which the report does not quantify.
Why is Russia described as particularly exposed?
The report says PHP powers more than 90% of Russian websites. That indicates broad reliance on the language, but does not mean every Russian site is vulnerable or has been attacked.
Have attackers exploited the flaws?
The supplied report does not confirm exploitation in the wild. It describes the vulnerabilities, available updates and some temporary precautionary measures, while leaving the number of affected or compromised sites unknown.
Source: rss
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
