Critical PHP Flaws Under Active Attack: Why Your Website May Need Urgent Updates Today

Many websites may show error pages today as organisations rush to fix two critical vulnerabilities in PHP, the programming language behind platforms such as WordPress, Drupal, Magento and Joomla. The flaws could let an attacker run their own code on a vulnerable server and take full control. Experts say working exploits exist and the bugs are already being used in real attacks. Nearly 70 percent of websites reportedly need to update their core software.

Reuters reports that government websites in Europe and elsewhere went offline after the flaws were disclosed. Cloudflare said it has seen some exploitation and, at 3:02 am (UTC), added web application firewall rules to help block attack traffic. It says the bugs could cause denial of service, remote code execution and data exposure. Researchers at Wiz said every PHP version released in the last decade is affected by at least one of the flaws.

The researchers said the underlying problems had existed for decades, but turning them into a working exploit required an exceptionally complex chain of steps. They said advanced AI models substantially lowered that barrier. OpenAI, which was involved in the research and outreach, called this one of the most impactful security issues in recent memory. This article covers only the opening of the original report, so check PHP's official advisory and your website provider for specific update details.