Two serious vulnerabilities in the PHP programming language forced governments and corporations to take websites offline preemptively against potential attacks. These flaws were rated with a severity score of 9.2 on an international scale and allow attackers to execute remote commands on exposed servers without needing access credentials or passwords.
PHP developers implemented updates to fix these issues on Wednesday, the 21st. Security authorities advise that the fixes be applied immediately; alternatively, vulnerable systems must be isolated from the internet until protection is established.
One of the vulnerabilities drew attention because it was originally detected in 2024. According to the PHP Foundation, the time elapsed for the correction indicates a structural failure in the process. The disclosure of the updates also raised concerns among experts due to the risk of attackers studying the patches to discover exploitation methods in systems that have not yet been updated.
PHP developers released four distinct updates to address the two critical vulnerabilities. The PHP Foundation emphasized the urgent need for users to update their systems. The foundation acknowledged that one of the flaws was pointed out by a researcher in 2024, classifying the delay in correction as a structural problem.
The United States National Security Agency (NSA) issued an alert indicating that vulnerabilities of this magnitude can facilitate access to server files and databases. If immediate application of an update is not feasible, the guidance is to remove the affected systems from the network.
Meanwhile, the United States Cybersecurity and Infrastructure Security Agency (CISA) recommended the immediate updating of all PHP installations. As of the time of Reuters' publication, the agency had not noted any exploitation of these vulnerabilities, although it warned about the dangers of keeping systems unprotected.
For Don Smith, Vice President of Threat Intelligence at Sophos Counter Threat Unit (CTU), the first hurdle faced by organizations is determining where PHP is being used. He stated: 'The immediate challenge is not just installing a fix, but identifying and managing all instances where PHP is running.'
The expert stressed that the language can be present in various locations, such as public websites, content management systems, hosting platforms, and third-party products, and that in some situations, this presence may not be obvious to the organization responsible for the infrastructure.
Smith suggested that security teams prioritize several actions. The executive also warned about the speed at which malicious actors can operate, including using artificial intelligence (AI). In his analysis, these vulnerabilities could become primary targets in the hours and days following the release of the fixes.
Thus, Smith advised that organizations should not limit themselves only to installing updates, but should also investigate whether any attacker has already gained access to the environment before the fixes were applied.
Researchers from the security company Calif, in partnership with OpenAI, reported one of the vulnerabilities to PHP developers on August 11th, after identifying it with the help of the GPT-5.6 Sol model. Wiz, another security company associated with Alphabet (Google's parent company), independently identified the problems and reported a second flaw on August 24th, also employing AI models.
This discovery demonstrated how AI tools can assist researchers in locating flaws in widely used software. However, the possibility of attackers analyzing the fixes reinforces the urgency of keeping affected systems updated and monitoring any suspicious activity.