PHP patches land as critical flaws put 1.5 million hosts at risk
What's new: PHP issued four fixes, while U.S. and European agencies urged operators to patch immediately or take systems offline.
PHP developers released four patches for two critical vulnerabilities after the flaws triggered a global scramble to protect websites and server infrastructure. The bugs can let attackers run malicious code on affected systems, raising the risk of access to file systems and databases. Data from Censys cited by The Straits Times showed about 1.5 million of 2.6 million internet hosts report using a PHP version with no fix. Government sites in Europe went offline as a precaution, while Wikipedia and the Internet Archive also pulled some systems for patching. The PHP Foundation called the delayed response to one flaw a “structural failure,” and U.S. agencies including the NSA and CISA urged organizations to update at once or disconnect vulnerable systems.