PHP devs publish critical bug fix as site owners warned: Pull ’em offline if you’re unpatched
PHP developers have released emergency updates for two critical flaws that could let unauthenticated attackers run code on affected web servers. Cybersecurity authorities urged organisations to patch immediately, while warning that internet-facing applications should be isolated or taken offline if they cannot be updated.
The fixes are in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35; both flaws have CVSS scores of 9.2. Exploit attempts have been observed, though none had succeeded according to a threat intelligence firm, and Finnish government services, Dutch public-sector sites and campaign group noyb temporarily went offline as a precaution. PHP underpins widely used platforms such as WordPress, Drupal, Joomla and Magento, making it difficult to identify every exposed installation.
- Two critical PHP flaws could enable unauthenticated remote code execution.
- Emergency fixes are available across four supported PHP branches.
- Some public websites went offline while owners assessed their exposure.